CDFI Memory Forensics & Volatile Data Analysis 3

Question 1

In Linux memory forensics, which special file provides access to the system's physical memory for acquisition purposes?

Accepted Answer

/dev/mem

Answer

/dev/mem is the character device file in Linux that represents physical memory and is used as a source for live memory acquisition on Linux systems.

Question 2

What forensic value do Windows crash dump files (BSOD memory dumps) provide to a digital forensics investigator?

Accepted Answer

They capture a snapshot of kernel memory at the moment of the crash, preserving process and network artifacts

Answer

Windows crash dumps preserve kernel memory state including running processes, loaded modules, and network connections at the time of the crash, providing valuable forensic evidence.

Question 3

Which Volatility plugin should be used for Windows 7 and later systems to identify both active and recently closed network connections from a memory image?

Accepted Answer

netscan

Answer

The `netscan` plugin supports Windows Vista/7 and later, scanning memory for network structures to identify active and recently terminated TCP/UDP connections.

Question 4

What is the forensic significance of finding a process in memory whose executable image path differs from its expected on-disk location?

Accepted Answer

It may indicate process masquerading or a code injection technique used by malware

Answer

A mismatch between the in-memory image path and the expected on-disk location is a strong indicator of process name spoofing or malware injecting into a legitimate process.

Question 5

Which memory forensics technique compares a potentially compromised memory image against a known-good baseline to identify anomalies?

Accepted Answer

Differential analysis (memory diffing)

Answer

Differential analysis (memory diffing) compares a suspicious memory image against a clean baseline to quickly surface unauthorized processes, modules, or memory modifications.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI Memory Forensics & Volatile Data Analysis 3