Certified Hacking Forensic Investigator (CHFI) Exam Prep | Already Graded

Certified Hacking Forensic Investigator (CHFI) Exam Prep | Already Graded What is a swap file? - Space on a hard disk used as virtual memory expansion for RAM System time is one example of volatile information that forensic investigators should collect. What are types of time that should be recorded? - System time, wall time, time system has been running (Date /t and Time /t can be typed in a command prompt in windows to retrieve the system time) Choose the list of tools and commands used to determine logged-on users: - PsLoggedOn, Net Sessions, LogonSession What tools can be used to see which files are open? - Net file, PsFile, Openfiles (Net file reveals names of all open shared files and the number of file locks, PsFile shows list of files open remotely, openfiles can be used to list or disconnect all open files and folders)