Extracting Google Drive Artifacts with RegScanner
Which tool does the investigator use to extract artifacts left by Google Drive on the system?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of where cloud client applications leave forensic traces and which tool harvests them; the trap is confusing a registry-scanning utility with memory-capture or process-analysis tools that target entirely different evidence sources.
When Google Drive is installed on a Windows host, it persists settings, account identifiers, sync metadata, and path information in the Windows Registry, which makes the registry a key artifact source for cloud-storage investigations in CHFI 312-49v10. The question establishes that RegScanner (NirSoft) is the tool used to locate and export those Google Drive registry artifacts.
Many learners pick C, RAM Capturer, reasoning that Google Drive is cloud-related and RAM capture is 'live' forensics; however, Belkasoft Live RAM Capturer images volatile memory and does not enumerate the registry keys where Google Drive stores its persistent metadata. PEBrowse Professional and Dependency Walker analyze process environments and DLL dependency trees, not application artifact stores.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Google Drive on Windows writes persistent configuration, account, and synchronization artifacts into the Windows Registry, so an investigator must use a registry interrogation utility to recover them. RegScanner from NirSoft recursively scans registry hives, displays matching key and value data in a grid, and exports results — exactly the workflow needed to pull Google Drive traces such as install paths, user identifiers, and last-sync values. This aligns with the CHFI cloud-forensics coverage, where recovering artifacts from cloud clients installed on endpoints is a standard objective.Why the Other Options Are Wrong
Belkasoft Live RAM Capturer (option C) acquires a full physical memory image for volatility analysis such as mounted cloud sessions or decryption keys; it does not extract persisted registry artifacts, so it answers a different forensic question. PEBrowse Professional (option A) inspects the process environment block of running processes — module lists, handles, and thread data — not the registry hive contents that hold Google Drive metadata. Dependency Walker (option D) maps PE module dependency chains and loaded DLLs, a static binary-inspection task with no relationship to extracting Google Drive's registry footprint.Community Comment Notes
One commenter argued for option C, citing Belkasoft Live RAM Capturer and a Forensic Focus webinar on acquiring RAM and cloud storage; that reasoning conflates memory acquisition with registry artifact extraction, so it does not fit the wording "extract artifacts left by Google Drive on the system." The other contributors, including aqeel1506, correctly explain that Google Drive stores settings and metadata in the Registry and that RegScanner exports that data, while PEBrowse analyzes the process environment and Dependency Walker handles DLL dependencies.Official Reference
Exam Strategy
Read carefully which evidence store the stem names: artifacts left 'on the system' by an installed cloud client usually means registry keys and files, not volatile memory. Match the tool to the store — registry scanners for registry traces, RAM capture tools only when the question asks for volatile memory.
Frequently Asked Questions
Why is RAM Capturer not the right tool for extracting Google Drive artifacts?
Belkasoft Live RAM Capturer acquires volatile memory for RAM analysis, but Google Drive's persistent metadata — account IDs, paths, sync settings — is written to the Windows Registry, which RAM capture does not enumerate.
What does PEBrowse Professional or Dependency Walker actually do in an investigation?
PEBrowse Professional inspects a running process's environment block (modules, handles, threads), and Dependency Walker maps PE module and DLL dependencies — neither reads registry-based application artifacts.