At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
A.
To create a file on the USB drive that contains a listing of the C: drive
B.
To show hidden and archived files on the C: drive and copy them to the USB drive
C.
To copy a forensic image of the local C: drive onto the USB drive
D.
To compare a list of known good hashes on the USB drive to files on the local C: drive
This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit