Examice

Exam GCIH All QuestionsBrowse all questions from this exam

Go to Exam

Question 124

Which of the following Volatility commands will display the date and time an image was collected?

python vol.py -f Win2k12x64.vmsn --profile=Win2012R2x64 --kdbg=0xf800f17dd9b0 timeliner --type=_CMHIVE

python vol.py -f ~/Desktop/win7_trial_64bit.raw imageinfo

python vol.py -f ~/Desktop/win7_trial_64bit.raw --profile=Win7SP0x64 printkey -K "Microsoft\Security Center\Svc"

python vol.py -f win7.vmem --profile=Win7SP0x86 userassist

Correct Answer: B

The Volatility command to display the date and time an image was collected is 'imageinfo'. This command provides general information about the memory image, including details such as the date and time the memory image was captured, the operating system, service pack, and other metadata that can help with further analysis.

Discussion

Ax3l91Option: B

imageinfo

XBalOption: B

Answer should be "B". https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#imageinfo