Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CHFI Certificate > Windows_Forensics > Flashcards

Windows_Forensics Flashcards

CHFI

1
Q

-

A

This parameter displays the supported options and the units of measurement used for output values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

-a

A

Displays all active TCP connections as well as the TCP and UDP ports on which the computer is listening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

-e

A

Displays Ethernet statistics, such as the number of bytes and packets sent and received. This parameter can be combined with -s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

-l

A

This parameter is used to show only local logons instead of both local and network resource logons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

-n

A

Displays active TCP connections. However, the addresses and port numbers are expressed numerically with no specified names.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

-o

A

Displays active TCP connections and includes the process ID (PID) for each connection. Using the PID, the application can be found in the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

-r

A

Displays the count of all NetBIOS names resolved by broadcast and by querying a Windows Internet Naming Service (WINS) server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

-x

A

This parameter tells the command not to show logon times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

/s Computer

A

Specifies the name or IP address of a remote computer (do not use backslashes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

/svc

A

Lists all the service information for each process without truncation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

/u Domain \ User

A

Runs the command with the account permissions of the user specified by User or Domain\User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

/v

A

Specifies that verbose task information be displayed in the output; it should not be used with the /svc or the /m parameter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

\<computer></computer>

A

This parameter specifies the name of the computer for which logon information is to be listed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

4728

A

A member was added to a security-enabled global group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

4730

A

A security-enabled global group was deleted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

4733

A

A member was removed from a security-enabled local group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

4735

A

local group was changed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

4755

A

A security-enabled universal group was changed

19
Q

4756

A

A member was added to a security-enabled universal group

20
Q

4757

A

A member was removed from a security-enabled universal group

21
Q

4758

A

security-enabled universal group was deleted.

22
Q

Clipboard contents

A

is the temporary storage area where the system stores data during copy and paste operations.

23
Q

DataStore.edb

A

Stores Windows updates information (Located under C:\windows\SoftwareDistribution\DataStore)

24
Q

Driver/service information

A

When the system starts, services and drivers start automatically based on entries in the registry. Users/system administrators do not install all the services, some malware installs itself as a service or system driver. Check service/driver information for any malicious program installed

25
Q

Interval

A

Redisplays the selected information after an interval of defined number of seconds.

26
Q

ipconfig command

A

is a command line utility, which the investigator can use to find out information about NICs and the current Transmission Control Protocol/Internet Protocol (TCP/IP) configuration. Ipconfig also accepts various Dynamic Host Configuration Protocol (DHCP) commands, thereby allowing a system to update or release its TCP/IP network configuration.

27
Q

Listdlls

A

is a utility that lists all DLLs loaded in all processes, into a specific process, or to list the processes that have a particular DLL loaded.

28
Q

logonsessions [-c[t]] [-p]

A

when run without any options, lists the currently active logged-on sessions. If the -p option is used, it provides information on the processes running in each session.

29
Q

nbstat

A

This command is used to display protocol and statistical information for NetBIOS over TCP/IP

30
Q

nbtstat

A

helps troubleshoot NetBIOS name resolution problems. When a network is functioning normally, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses.

31
Q

net file

A

command reflects names of all files that are open on the server and the number of file locks on each file, if any. This command can also close individually shared files and remove file locks.

32
Q

net file command

A

Displays details of open shared files on a server, such as a name, ID, and the number of each file locks, if any. It also closes individually shared files and removes file locks.

33
Q

net sessions [\] [/delete] [/list]

A

The net sessions command is used for managing server computer connections. When used without parameters, it displays information about all logged-in sessions of the local computer.

34
Q

Netstat

A

To collect information on network connections, investigators should run the netstat command, which enables the retrieval of information related to all TCP and UDP ports open for connection, routing tables, etc. It displays network connections, a number of network interface (network interface controller or software-defined network interface) and network protocol statistics.

35
Q

PsList

A

displays elementary information about all the processes running on a system.

36
Q

psloggedon [- ] [-l] [-x] [\computername | username]

A

is an applet that displays both the locally logged-on users as well as users logged-on remotely

37
Q

Spartan.edb

A

Stores the Favorites of Internet Explorer 10/11. (Stored under %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049)

38
Q

Spool files

A

printer files

39
Q

THC Hydra

A

is a parallelized login cracker that can attack numerous protocols.

40
Q

wevtutil

A

command can be used to retrieve information about event logs and publishers that is not readily apparent via the Event Viewer user interface.

41
Q

Windows.edb

A

Stores index information (for Windows search) by Windows OS

42
Q

/delete

A

This parameter ends the session with the specified client computer and closes all open files on the local computer for the session.

43
Q

-c

A

Shows the contents of the NetBIOS remote name cache table, which contains NetBIOS name-to-IP address mappings

44
Q

-s

A

displays statistics by protocol

CHFI Certificate (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions