GCED: GIAC Certified Enterprise DefenderDemo

Question

At the beginning of an investigation on a Windows system, the lead handler runs the following command after inserting a USB drive. What is this command intended to do?

C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

A To create a file on the USB drive that contains a listing of the C: drive
B To show hidden and archived files on the C: drive and copy them to the USB drive
C To copy a forensic image of the local C: drive onto the USB drive
D To compare a list of known good hashes on the USB drive to files on the local C: drive

Explanation

dir creates a directory listing, /s traverses subdirectories, and /a can include files and directories with the specified attributes. The > redirection operator writes that listing to IRCD.txt on the USB drive; it does not copy the listed files, acquire a forensic image, or compare hashes. Microsoft documents that dir displays directory contents and that its output can be redirected to a file.

Learn more

dir command

GCED: GIAC Certified Enterprise DefenderDemo

AstroTutor

Notes

Readiness

QuestionQ3

Community Discussion