GIAC
GCFE · Question #109
A forensic investigator needs to track USB devices connected to a corporate laptop involved in intellectual property theft. What steps should the investigator take to gather this evidence? (Choose…
The correct answer is A. Analyze system logs for USB connections B. Review the registry for USB device information D. Examine event logs for file transfers. See the full explanation below for the reasoning.
Question
A forensic investigator needs to track USB devices connected to a corporate laptop involved in intellectual property theft. What steps should the investigator take to gather this evidence? (Choose three)
Options
- AAnalyze system logs for USB connections
- BReview the registry for USB device information
- CSearch for Prefetch files
- DExamine event logs for file transfers
- EReview installed software logs
How the community answered
(43 responses)- A72% (31)
- C19% (8)
- E9% (4)
Community Discussion
No community discussion yet for this question.