An attacker disables Windows functionality such as last access timestamp, hibernation, virtual memory, system restore points, etc. to cover tracks. Which action is described?

An attacker disables Windows functionality such as last access timestamp, hibernation, virtual memory, system restore points, etc. to cover tracks. Which action is described?

• A. Disabling Windows Functionality
• B. Disabling Auditing
• C. Covering Tracks on the OS
• D. Clearing Logs

Answer: (A)

Disabling Windows functionality is the best fit because the attacker is not just deleting logs or turning auditing off; they are turning off parts of the operating system that can produce or preserve evidence. Features like last access timestamps determine when a file was read, hibernation saves the system’s memory state, virtual memory handles paging data, and system restore points capture snapshots of the system. If these are disabled, traces are less likely to be left behind and it becomes harder for investigators to reconstruct actions. Clearing logs would only affect log files, and disabling auditing is a narrower tactic focused on logs rather than the broader set of evidentiary controls being turned off. By targeting multiple functionalities, the attacker aims to reduce available traces, which fits the idea of disabling Windows functionality.

Disabling Windows functionality is the best fit because the attacker is not just deleting logs or turning auditing off; they are turning off parts of the operating system that can produce or preserve evidence. Features like last access timestamps determine when a file was read, hibernation saves the system’s memory state, virtual memory handles paging data, and system restore points capture snapshots of the system. If these are disabled, traces are less likely to be left behind and it becomes harder for investigators to reconstruct actions. Clearing logs would only affect log files, and disabling auditing is a narrower tactic focused on logs rather than the broader set of evidentiary controls being turned off. By targeting multiple functionalities, the attacker aims to reduce available traces, which fits the idea of disabling Windows functionality.