Computer Hacking Forensic Investigator (CHFI v10) — Question 95

Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer. Where should Harold navigate on the computer to find the file?

Answer options

• A. %systemroot%\system32\LSA
• B. %systemroot%\system32\drivers\etc
• C. %systemroot%\repair
• D. %systemroot%\LSA

Correct answer: C

Explanation

The correct answer is C, as the backup SAM files created by the rdisk /s command are stored in the %systemroot%\repair directory. The other options do not contain the backup files; %systemroot%\system32\LSA is related to LSA configuration, %systemroot%\system32\drivers\etc is primarily for host and services files, and %systemroot%\LSA does not exist as a standard directory.