GIAC
GCFE · Question #111
What is the significance of 'shadow copies' in Windows in a forensic investigation?
The correct answer is A. They are automatic backups of files and folders that can provide earlier versions of data, useful. See the full explanation below for the reasoning.
Question
What is the significance of 'shadow copies' in Windows in a forensic investigation?
Options
- AThey are automatic backups of files and folders that can provide earlier versions of data, useful
- BThey log user activity in real-time chat applications.
- CThey provide a continuous record of system error messages.
- DThey monitor the installation of device drivers.
How the community answered
(43 responses)- A74% (32)
- B16% (7)
- C2% (1)
- D7% (3)
Community Discussion
No community discussion yet for this question.