312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ211

Logs and Network Forensics

A forensic team at a multinational corporation is investigating a suspected data breach. After carefully reviewing system logs, the team finds consistent outbound traffic from an internal system to a suspicious IP address associated with dark web activity. On examining the affected system, they determine that the user had used TOR for unauthorized activities. To obtain additional evidence of TOR use, which of the following techniques is least likely to produce substantial results?

  • A Scanning Prefetch files for instances of TOR execution.
  • B Analyzing Command Prompt history for traces of TOR-related commands.
  • C Monitoring real-time network traffic to identify connections to TOR nodes.
  • D Inspecting the Windows Registry for TOR-related entries.
Explanation

Command Prompt history is a weak source of TOR evidence because TOR can be launched and used through its graphical browser without any TOR-related command being entered in cmd.exe. Windows DOSKEY command history is stored in memory for the relevant command session, so it may also be absent after that session ends. In contrast, execution artifacts, Registry artifacts, and real-time network connections can provide more direct evidence of TOR activity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!