nerdexam
GIAC

GCFE · Question #111

What is the significance of 'shadow copies' in Windows in a forensic investigation?

The correct answer is A. They are automatic backups of files and folders that can provide earlier versions of data, useful. See the full explanation below for the reasoning.

Question

What is the significance of 'shadow copies' in Windows in a forensic investigation?

Options

  • AThey are automatic backups of files and folders that can provide earlier versions of data, useful
  • BThey log user activity in real-time chat applications.
  • CThey provide a continuous record of system error messages.
  • DThey monitor the installation of device drivers.

How the community answered

(43 responses)
  • A
    74% (32)
  • B
    16% (7)
  • C
    2% (1)
  • D
    7% (3)

Community Discussion

No community discussion yet for this question.

Full GCFE Practice