Extracting Google Drive Artifacts with RegScanner
Short answer
B Use NirSoft RegScanner to scan and export the Windows Registry keys where Google Drive stores its configuration and synchronization artifacts.
Question
Key Takeaways
The question tests knowledge of where cloud client applications leave forensic traces and which tool harvests them; the trap is confusing a registry-scanning utility with memory-capture or process-analysis tools that target entirely different evidence sources.
When Google Drive is installed on a Windows host, it persists settings, account identifiers, sync metadata, and path information in the Windows Registry, which makes the registry a key artifact source for cloud-storage investigations in CHFI 312-49v10. The question establishes that RegScanner (NirSoft) is the tool used to locate and export those Google Drive registry artifacts.
Common mistake: Many learners pick C, RAM Capturer, reasoning that Google Drive is cloud-related and RAM capture is 'live' forensics; however, Belkasoft Live RAM Capturer images volatile memory and does not enumerate the registry keys where Google Drive stores its persistent metadata. PEBrowse Professional and Dependency Walker analyze process environments and DLL dependency trees, not application artifact stores.
Expert Analysis
Why the Answer Is Correct
Google Drive on Windows writes persistent configuration, account, and synchronization artifacts into the Windows Registry, so an investigator must use a registry interrogation utility to recover them. RegScanner from NirSoft recursively scans registry hives, displays matching key and value data in a grid, and exports results — exactly the workflow needed to pull Google Drive traces such as install paths, user identifiers, and last-sync values. This aligns with the CHFI cloud-forensics coverage, where recovering artifacts from cloud clients installed on endpoints is a standard objective.
Why the Other Options Are Wrong
Belkasoft Live RAM Capturer (option C) acquires a full physical memory image for volatility analysis such as mounted cloud sessions or decryption keys; it does not extract persisted registry artifacts, so it answers a different forensic question. PEBrowse Professional (option A) inspects the process environment block of running processes — module lists, handles, and thread data — not the registry hive contents that hold Google Drive metadata. Dependency Walker (option D) maps PE module dependency chains and loaded DLLs, a static binary-inspection task with no relationship to extracting Google Drive's registry footprint.
Community Comment Notes
One commenter argued for option C, citing Belkasoft Live RAM Capturer and a Forensic Focus webinar on acquiring RAM and cloud storage; that reasoning conflates memory acquisition with registry artifact extraction, so it does not fit the wording "extract artifacts left by Google Drive on the system." The other contributors, including aqeel1506, correctly explain that Google Drive stores settings and metadata in the Registry and that RegScanner exports that data, while PEBrowse analyzes the process environment and Dependency Walker handles DLL dependencies.
Official Reference
https://www.nirsoft.net/utils/regscanner.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
Read carefully which evidence store the stem names: artifacts left 'on the system' by an installed cloud client usually means registry keys and files, not volatile memory. Match the tool to the store — registry scanners for registry traces, RAM capture tools only when the question asks for volatile memory.
Frequently Asked Questions
Why is RAM Capturer not the right tool for extracting Google Drive artifacts?
What does PEBrowse Professional or Dependency Walker actually do in an investigation?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1The correct answer is B. RegScanner. RegScanner is a tool used to extract artifacts from the Windows Registry, including those left by Google Drive. Google Drive stores its settings and metadata in the Registry, and RegScanner can help investigators extract this information. Here's a brief explanation of the other options: A. PEBrowse Professional: A tool used to analyze the Windows Process Environment Block (PEB) and extract information about running processes, not related to Google Drive artifacts. C. RAM Capturer: A tool used to capture and analyze the contents of physical memory (RAM), not related to Google Drive artifacts. D. Dependency Walker: A tool used to analyze the dependencies and libraries used by executable files, not related to Google Drive artifacts.
-
Elb 👍 1C > Belkasoft Live RAM Capturer is a forensic tool that allows extracting the entire contents of a computer’s volatile memory https://www.forensicfocus.com/webinars/acquiring-removable-drives-mobile-devices-ram-and-cloud-storage/
-
4bd3116 👍 1 Answered BThe correct answer is B. RegScanner. This tool is used to extract artifacts left by Google Drive on the system.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.