Computer Hacking Forensic Investigator (CHFI v10) — Question 337

Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?

Answer options

• A. Events history
• B. Previously typed commands
• C. History of the browser
• D. Passwords used across the system

Correct answer: B

Explanation

The correct answer is B because the doskey/history command displays previously entered commands in the command line, which is useful for understanding user actions. The other options do not relate to the function of the doskey/history command; it does not log events, browser history, or passwords.