Digital Forensic Certification Practice Exam

Which command can be used to verify active network connections related to potential Tor usage?

1. ipconfig

2. tracert

3. ping

4. netstat -ano

The correct answer is: netstat -ano

The command that can be used to verify active network connections related to potential Tor usage is "netstat -ano." This command provides a comprehensive view of all active network connections on a system, along with the associated process IDs (PIDs) for each connection. By using "netstat -ano," a forensic investigator can see which network ports are being used, the local and remote addresses involved in these connections, and by which processes they are being established. This is particularly useful for detecting Tor connections because the Tor software operates by creating a series of network connections to various nodes in a distributed network. Analyzing the output from this command, investigators can identify connections that are likely related to Tor usage, especially by looking for connections to known Tor relay addresses or ports, such as 9050 (the default port used by Tor). This makes "netstat -ano" a valuable tool in digital forensics for assessing potential Tor activity on a machine. The other commands listed, such as "ipconfig," "tracert," and "ping," do not provide the same level of detail regarding active connections or associated processes. "ipconfig" is primarily used to view or configure network interface settings, "tracert" is used to