Discuss GIAC GCED Exam Topic 7 Question 79

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

ATo create a file on the USB drive that contains a listing of the C: drive

BTo show hidden and archived files on the C: drive and copy them to the USB drive

CTo copy a forensic image of the local C: drive onto the USB drive

DTo compare a list of known good hashes on the USB drive to files on the local C: drive

Suggested Answer: C

This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Gaynell 22 days ago

Exactly, B is the best choice here.

Zona 28 days ago

Right, D seems off. Focus is on files, not hashes.

Beatriz 1 month ago

D is unlikely. No hashes mentioned in the command.

Vilma 1 month ago

C sounds too extreme for just listing files.

Tarra 1 month ago

But A doesn't explain the hidden files part. B covers that.

Rhea 2 months ago

A is interesting too. Creating a file could help with organization.

Gaynell 2 months ago

I agree, B makes sense. Hidden files can be key evidence.

Zona 2 months ago

I think it's B. Showing hidden files is crucial.

Barrett 2 months ago

Sounds like a simple directory command to me!

Vannessa 2 months ago

I thought it was about showing hidden files, but I guess not?

Emilio 2 months ago

Wait, are we sure it’s not copying files? Seems off.

Rolf 3 months ago

Definitely option A, makes the most sense.

Moon 3 months ago

It's creating a file on the USB with a C: drive listing.

Bette 3 months ago

I don't think it's about copying a forensic image; that sounds too complex for just a dir command. It must be more about listing files or attributes.

Cassie 3 months ago

I feel like option A makes sense because it mentions creating a file on the USB, but I’m not entirely confident about the specifics of the command.

Kenia 3 months ago

I remember practicing a similar question where we had to identify commands that show hidden files. This seems like it could be related to that.

Georgiann 4 months ago

I think the command is trying to list files, but I'm not sure if it's just for the C: drive or if it's also copying them to the USB.

GIAC GCED Exam - Topic 7 Question 79 Discussion