CDFI Memory Forensics & Volatile Data Analysis 2

Question 1

What is the EPROCESS structure in Windows memory forensics?

Accepted Answer

The kernel executive process object containing all metadata about a running process

Answer

EPROCESS is the Windows kernel's executive process object, containing fields such as PID, PPID, image name, token, handle table, and linked-list pointers.

Question 2

What is Direct Kernel Object Manipulation (DKOM) and why is it forensically significant?

Accepted Answer

A rootkit technique that modifies kernel data structures to hide malicious processes or objects

Answer

DKOM allows rootkits to hide processes by unlinking EPROCESS entries from the active process list, making them invisible to tools that walk the linked list.

Question 3

Which Volatility plugin best detects processes hidden by DKOM by scanning raw memory pool tags rather than walking linked lists?

Accepted Answer

psscan

Answer

`psscan` scans physical memory for EPROCESS pool tags directly, finding processes that DKOM has unlinked from the active process list.

Question 4

What is the purpose of analyzing the Virtual Address Descriptor (VAD) tree in Windows memory forensics?

Accepted Answer

To map the virtual memory layout of a process and identify suspicious injected code regions

Answer

The VAD tree describes all virtual memory regions allocated within a process, and anomalous regions with RWX permissions and no backing file often indicate code injection.

Question 5

Which type of artifact found in memory forensics is generally NOT recoverable through disk-based forensic analysis?

Accepted Answer

Plaintext contents of encrypted volumes that are actively mounted

Answer

Encrypted volume contents are decrypted in RAM while the container is mounted, so memory forensics is the only way to capture plaintext data from active encrypted volumes.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI Memory Forensics & Volatile Data Analysis 2