GIAC Exam GCED Topic 8 Question 60 Discussion

Actual exam question for GIAC's GCED exam

Question #: 60
Topic #: 8

[All GCED Questions]

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

ATo create a file on the USB drive that contains a listing of the C: drive

BTo show hidden and archived files on the C: drive and copy them to the USB drive

CTo copy a forensic image of the local C: drive onto the USB drive

DTo compare a list of known good hashes on the USB drive to files on the local C: drive

Show Suggested Answer

Suggested Answer: E

After selecting ''fix it!'' with Hijack This you can always restore deleted items, because Hijack This keeps a backup of them.

by Paola at Mar 03, 2025, 07:19 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dacia

4 days ago

Nah, I don't think that's it. The command seems to be checking for hidden and archived files on the C: drive and copying them to the USB drive. Gotta love those hidden files, they could hold the key to the whole investigation!

upvoted 0 times

...

Kanisha

15 days ago

I think the purpose of this command is to create a file on the USB drive that contains a directory listing of the C: drive. It's a basic way to gather some initial information about the system.

upvoted 0 times

...