CDFI Memory Forensics & Volatile Data Analysis 2 — Questions and Answers
Question 1: What is the EPROCESS structure in Windows memory forensics?
- A kernel structure storing active network connection metadata
- The kernel executive process object containing all metadata about a running process (Correct answer)
- A memory region holding cryptographic keys used by the Windows security subsystem
- A data structure that caches Windows Registry hives in RAM
Correct answer: The kernel executive process object containing all metadata about a running process
EPROCESS is the Windows kernel's executive process object, containing fields such as PID, PPID, image name, token, handle table, and linked-list pointers.
Question 2: What is Direct Kernel Object Manipulation (DKOM) and why is it forensically significant?
- A method for optimizing kernel memory allocation to improve performance
- A rootkit technique that modifies kernel data structures to hide malicious processes or objects (Correct answer)
- A forensic technique for safely examining live kernel memory
- A Windows debugging API used for kernel-level crash analysis
Correct answer: A rootkit technique that modifies kernel data structures to hide malicious processes or objects
DKOM allows rootkits to hide processes by unlinking EPROCESS entries from the active process list, making them invisible to tools that walk the linked list.
Question 3: Which Volatility plugin best detects processes hidden by DKOM by scanning raw memory pool tags rather than walking linked lists?
- pslist
- pstree
- psscan (Correct answer)
- cmdline
Correct answer: psscan
`psscan` scans physical memory for EPROCESS pool tags directly, finding processes that DKOM has unlinked from the active process list.
Question 4: What is the purpose of analyzing the Virtual Address Descriptor (VAD) tree in Windows memory forensics?
- To reconstruct DNS query history stored in the DNS resolver cache
- To map the virtual memory layout of a process and identify suspicious injected code regions (Correct answer)
- To recover deleted registry keys that have been unmapped from the hive
- To enumerate active TCP/UDP connections associated with a process
Correct answer: To map the virtual memory layout of a process and identify suspicious injected code regions
The VAD tree describes all virtual memory regions allocated within a process, and anomalous regions with RWX permissions and no backing file often indicate code injection.
Question 5: Which type of artifact found in memory forensics is generally NOT recoverable through disk-based forensic analysis?
- NTFS file timestamps and metadata
- Plaintext contents of encrypted volumes that are actively mounted (Correct answer)
- Master File Table (MFT) records for existing files
- Deleted file fragments in unallocated disk clusters
Correct answer: Plaintext contents of encrypted volumes that are actively mounted
Encrypted volume contents are decrypted in RAM while the container is mounted, so memory forensics is the only way to capture plaintext data from active encrypted volumes.
Question 6: What can examining Master File Table (MFT) entries cached in memory reveal that may not be available through disk analysis alone?
- The current state of active TCP network connections
- File access patterns and recently accessed files providing additional timeline context (Correct answer)
- The list of currently logged-on user sessions
- The complete Windows Security Event Log contents
Correct answer: File access patterns and recently accessed files providing additional timeline context
MFT entries cached in memory may capture access timestamps and file activity not yet flushed to disk, enriching the forensic timeline.
Question 7: During memory analysis, a process has a Parent Process ID (PPID) pointing to a non-existent process. What does this most likely indicate?
- Normal Windows behavior that always occurs during system startup sequences
- A potential DKOM attack or a process spawned by malware that subsequently terminated to avoid detection (Correct answer)
- The process was launched from a Windows batch script or scheduled task
- Normal behavior when Windows services are gracefully restarted
Correct answer: A potential DKOM attack or a process spawned by malware that subsequently terminated to avoid detection
An orphaned PPID is a strong indicator that malware spawned a child process and then terminated itself, or that DKOM was used to manipulate process-parent relationships.
CDFI Memory Forensics & Volatile Data Analysis 2
What is the EPROCESS structure in Windows memory forensics?