Eccouncil Exam 312-49 Topic 1 Question 77 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 77
Topic #: 1

Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?

ARegistryChangesView

BRegDIIView

CRegRipper

DProDiscover

Show Suggested Answer

Suggested Answer: C

by Luann at Mar 06, 2025, 08:32 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

2 days ago

ProDiscover? Seriously? That's more of a general forensic suite, not specifically for registry analysis.

upvoted 0 times

...

5 days ago

I was just about to say RegRipper! It's a powerful tool for extracting and parsing registry data during investigations.

upvoted 0 times

...

17 days ago

RegRipper seems like the obvious choice here. It's a well-known forensic tool for analyzing registry files.

upvoted 0 times

...

21 days ago

I'm not sure, but I think A) RegistryChangesView could also be a useful tool for accessing registry files.

upvoted 0 times

...

23 days ago

I disagree, I believe the correct tool is D) ProDiscover.

upvoted 0 times

...

24 days ago

I think the answer is C) RegRipper.

upvoted 0 times

...