Recent Lessons

Show all results for ""

Windows Forensics Analysis: Acquisition and Memory Acquisition

Choose a study mode

Play Quiz

Study Flashcards

Spaced Repetition

Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Download our mobile app to listen on the go

Get App

Questions and Answers

What is the purpose of creating a custom content image in FTK Imager?

To extract registry hives and backup registry hives
To create a disk-to-image copy of the entire hard drive
To analyze the RECENT folder and subfolders
To image a live system, a dead system, or an image file (correct)

What type of files can be found in the User's Home folder of 'APPDATA'?

Registry hives and backup registry hives
Cache, history, cookies files, and more (correct)
Event Log files
Prefetch files

What is the purpose of using a hardware write-blocker in the imaging process?

To connect the evidence disk to the forensic workstation
To create a quick triage image
To boot to Windows
To prevent changes to the original evidence drive (correct)

What is the term for creating a copy of the entire hard drive at the logical partition and physical drive level?

Disk-to-image copy (D) Signup and view all the answers

What is the purpose of the RECENT folder and subfolders?

Not mentioned in the text (A) Signup and view all the answers

What is the tool used to create a disk image in the imaging process?

FTK Imager Lite (B) Signup and view all the answers

What is the purpose of the 'APPDATA' folder?

To store cache, history, cookies files, and more (A) Signup and view all the answers

What is the term for the process of creating a copy of the RAM?

Image Ram (D) Signup and view all the answers

What is the purpose of creating a triage image?

To perform a quick analysis of the evidence (B) Signup and view all the answers

What is RAID?

Not specified in the text (A) Signup and view all the answers

Flashcards are hidden until you start studying