CCP Disk & Memory Forensics 3

Question 1

Which type of memory contains the page file (pagefile.sys) that may hold remnants of previously running processes?

Accepted Answer

Virtual memory

Answer

Virtual memory uses pagefile.sys on disk to extend RAM; it can retain process memory artifacts long after a process terminates.

Question 2

During live forensics, an analyst runs 'netstat -an' and sees an established connection to an external IP on port 4444. What should be the immediate next step?

Accepted Answer

Capture a full memory dump before any changes

Answer

Capturing memory preserves volatile evidence including process handles, network connections, and encryption keys before they are lost.

Question 3

Which Windows artifact tracks program execution times, run counts, and is stored in C:\Windows\Prefetch?

Accepted Answer

Prefetch files (.pf)

Answer

Prefetch files record execution metadata for applications; each .pf file contains the executable name, run count, and last eight execution times.

Question 4

An examiner images a suspect SSD using a write blocker. After imaging, hash verification fails. What is the most likely explanation specific to SSDs?

Accepted Answer

Background garbage collection or wear leveling altered data

Answer

SSDs perform background operations like garbage collection and wear leveling that can modify data even when protected by a hardware write blocker.

Question 5

Which memory forensics artifact would reveal the password of an encrypted TrueCrypt volume if the volume was mounted at the time of acquisition?

Accepted Answer

Encryption keys stored in RAM

Answer

When an encrypted volume is mounted, the decryption keys reside in RAM and can be extracted from a memory image using tools like Volatility.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Disk & Memory Forensics 3