GIAC GCED Exam - Topic 7 Question 79 Discussion

Actual exam question for GIAC's GCED exam

Question #: 79
Topic #: 7

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

ATo create a file on the USB drive that contains a listing of the C: drive

BTo show hidden and archived files on the C: drive and copy them to the USB drive

CTo copy a forensic image of the local C: drive onto the USB drive

DTo compare a list of known good hashes on the USB drive to files on the local C: drive

Show Suggested Answer

Suggested Answer: C

This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.

by Benedict at May 28, 2026, 06:58 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!