Kaysen, a forensic investigator, was examining a compromised Windows machine.

This question aligns with CHFI v11 objectives underOperating System ForensicsandLive Data Acquisition. When investigating a compromised Windows system, collecting volatile data such as running processes and active services is critical, as this information exists only in memory and can be lost if the system is shut down. CHFI v11 emphasizes the use ofnative, low-impact system utilitiesduring live forensic response to minimize changes to the system state.

Thetasklistcommand is a built-in Windows utility that displays a list of currently running processes along with associated process IDs (PIDs), memory usage, and service relationships. It is specifically designed for real-time process enumeration and is commonly used in forensic investigations to identify suspicious or malicious processes with minimal system interaction. Because tasklist is native to Windows, it does not introduce external binaries that could alter evidence integrity.

ExifTool is used for metadata analysis, Wireshark captures network traffic rather than process data, and Hexinator is a hex editor used for file-level analysis, not live process enumeration. Therefore, in accordance with CHFI v11 best practices for volatile evidence collection on Windows systems,tasklistis the correct and most forensically sound tool for this scenario.