CDFI Memory Forensics & Volatile Data Analysis 3

Question 1

In Linux memory forensics, which special file provides access to the system's physical memory for acquisition purposes?

Accepted Answer

/dev/mem

Answer

/proc/kmem

Answer

/proc/kcore

Answer

/dev/sda1

Question 2

What forensic value do Windows crash dump files (BSOD memory dumps) provide to a digital forensics investigator?

Accepted Answer

They capture a snapshot of kernel memory at the moment of the crash, preserving process and network artifacts

Answer

They exclusively contain Windows Event Viewer log entries at crash time

Answer

They store encrypted copies of user account credentials for recovery

Answer

They are used solely for hardware diagnostics by Microsoft support personnel

Question 3

Which Volatility plugin should be used for Windows 7 and later systems to identify both active and recently closed network connections from a memory image?

Accepted Answer

netscan

Answer

connections

Answer

connscan

Answer

sockscan

Question 4

What is the forensic significance of finding a process in memory whose executable image path differs from its expected on-disk location?

Accepted Answer

It may indicate process masquerading or a code injection technique used by malware

Answer

It indicates the executable was recently updated through Windows Update

Answer

It is entirely normal behavior for all Windows system service processes

Answer

It indicates the executable is loading from a mapped network drive

Question 5

Which memory forensics technique compares a potentially compromised memory image against a known-good baseline to identify anomalies?

Accepted Answer

Differential analysis (memory diffing)

Answer

Dead-box forensics analysis

Answer

Live targeted acquisition

Answer

Hash-based triage analysis

Question 6

How does analyzing MFT timestamp data cached in memory help establish a forensic timeline during an investigation?

Accepted Answer

It allows correlation of file creation or modification times with the suspected time of compromise

Answer

It reveals the current CPU utilization history for each running process

Answer

It exposes the network ports and connections associated with each file

Answer

It identifies which user account was logged on when each file was accessed

Question 7

What is the correct first action when a suspect system is discovered powered on and potentially holding evidence in volatile memory?

Accepted Answer

Perform live memory acquisition first before any other action, following the Order of Volatility

Answer

Immediately remove the power cord to preserve disk evidence in its current state

Answer

Reboot the system into a forensic boot environment before imaging memory

Answer

Photograph the screen contents and then initiate a normal operating system shutdown