QuestionQ95

Tools/Systems/Programs

Following a major malware attack on a corporation, Bob, a forensic analyst, is asked to investigate. To conceal its tracks, the malware made numerous changes to files and folders throughout the system. Bob decides to closely monitor these changes to understand the malware’s operation. Which tool can Bob use to monitor and log all changes occurring in the system’s files and folders?

  • A IDA Pro
  • B EnCase
  • C Sysmon
  • D FTK Imager
Explanation

Sysmon is a Windows system-monitoring service that records detailed activity in the Windows event log, including file creation and file deletion events. Its telemetry can be used to track malware-related changes across the file system.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!