Question

During an incident investigation, you connect a live response session to a compromised Windows workstation in Microsoft Defender for Endpoint. You attempt to use the 'getfile' command to retrieve a suspected malware sample located at C:\Users\Public\payload.dll, which is 12 MB in size. The command fails. A colleague suggests the file is too large. What is the maximum file size that the live response 'getfile' command can retrieve, and what is the correct conclusion?

Accepted Answer

The limit is 3 GB; the 12 MB file size is not the cause, so investigate other issues such as the file being locked by a running process.

Answer

The limit is 10 MB; the 12 MB file exceeds it, so you must compress the file before retrieval.

Answer

The limit is 5 MB; the 12 MB file exceeds it, so use 'collect investigation package' instead.

Answer

The limit is 50 KB; the 12 MB file exceeds it, so upload the file to a library first.