CCP Disk & Memory Forensics 3 — Questions and Answers
Question 1: Which type of memory contains the page file (pagefile.sys) that may hold remnants of previously running processes?
- Physical RAM
- Virtual memory (Correct answer)
- CPU cache
- ROM
Correct answer: Virtual memory
Virtual memory uses pagefile.sys on disk to extend RAM; it can retain process memory artifacts long after a process terminates.
Question 2: During live forensics, an analyst runs 'netstat -an' and sees an established connection to an external IP on port 4444. What should be the immediate next step?
- Immediately power off the system
- Capture a full memory dump before any changes (Correct answer)
- Reboot into safe mode
- Delete the suspicious process
Correct answer: Capture a full memory dump before any changes
Capturing memory preserves volatile evidence including process handles, network connections, and encryption keys before they are lost.
Question 3: Which Windows artifact tracks program execution times, run counts, and is stored in C:\Windows\Prefetch?
- Shimcache
- Amcache
- Prefetch files (.pf) (Correct answer)
- UserAssist
Correct answer: Prefetch files (.pf)
Prefetch files record execution metadata for applications; each .pf file contains the executable name, run count, and last eight execution times.
Question 4: An examiner images a suspect SSD using a write blocker. After imaging, hash verification fails. What is the most likely explanation specific to SSDs?
- The write blocker malfunctioned
- Background garbage collection or wear leveling altered data (Correct answer)
- The forensic tool has a bug
- The suspect deleted files during imaging
Correct answer: Background garbage collection or wear leveling altered data
SSDs perform background operations like garbage collection and wear leveling that can modify data even when protected by a hardware write blocker.
Question 5: Which memory forensics artifact would reveal the password of an encrypted TrueCrypt volume if the volume was mounted at the time of acquisition?
- Page table entries
- Encryption keys stored in RAM (Correct answer)
- MBR boot record
- VSS shadow copy
Correct answer: Encryption keys stored in RAM
When an encrypted volume is mounted, the decryption keys reside in RAM and can be extracted from a memory image using tools like Volatility.
Question 6: Which Sleuth Kit (TSK) tool is used to list files and directories in an image file, including deleted ones?
- mmls
- fsstat
- fls (Correct answer)
- istat
Correct answer: fls
fls lists file and directory names from a file system image, flagging deleted entries with a '*' or '-' prefix.
Question 7: A suspect's hard drive shows a file carved from unallocated space with no corresponding MFT entry. What forensic technique was used?
- Log parsing
- File carving (Correct answer)
- Timeline analysis
- Registry analysis
Correct answer: File carving
File carving recovers files from raw disk data using file header and footer signatures, without relying on file system metadata.
CCP Disk & Memory Forensics 3
Which type of memory contains the page file (pagefile.sys) that may hold remnants of previously running processes?