Secureworks interview question

NTFS filesystem, Memory analysis, Incident response management.