Windows Forensics

What does the netstat command with the -ano options display?

• Network information

• Open files on the system

• Process information

• Dump File

Which tool can be used to examine the contents of an ESE database file?

• ESEDatabaseView

• DumpChk

• DriveLetterView

• Process Dumper

What is the purpose of examining Windows crash dumps in forensic investigation?

• To diagnose and identify bugs in a program

• To collect information about network connections

• To extract data from the Windows registry

• To determine the system uptime

Which command can be used to dump the memory of a process?

• PsLoggedOn

• netstat

• adplus.vbs

• Userdump.exe

What is the purpose of collecting slack space in forensic investigation?

• To determine the system uptime

• To identify the logged-on users

• To locate open files on the system

• To retrieve data from previously deleted files

Which tool can be used to examine the contents of a Windows search index?

• ESEDatabaseView

• DumpChk

• DriveLetterView

• Process Dumper

Which tool can be used to analyze RAM dumps?

• Belkasoft RAM Capturer

• AccessData FTK Imager

• Redline

• Hex Workshop

What type of information can be obtained from examining RAM dumps?

• Running services

• Accessed files and media

• System processes

• All of the above

What type of information can be obtained from Windows registry analysis?

• Software installed

• Hardware driver's configuration settings

• Suspicious user activity

• All of the above

Where are the Windows registry files located?

• C:\Windows\System32\config

• C:\Program Files\Windows\Registry

• C:\Users\{user}\AppData\Local\Microsoft\Windows\Registry

• C:\Windows\Registry