GCED: GIAC Certified Enterprise Defender

By GIAC · Question Mode

QuestionQ3

Digital Forensics Concepts and Application

At the beginning of an investigation on a Windows system, the lead handler runs the following command after inserting a USB drive. What is this command intended to do?

C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

Explanation

dir creates a directory listing, /s traverses subdirectories, and /a can include files and directories with the specified attributes. The > redirection operator writes that listing to IRCD.txt on the USB drive; it does not copy the listed files, acquire a forensic image, or compare hashes. Microsoft documents that dir displays directory contents and that its output can be redirected to a file.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!