CDFI Memory Forensics & Volatile Data Analysis

Question 1

What is the primary purpose of acquiring volatile memory (RAM) during a digital forensics investigation?

Accepted Answer

To preserve encryption keys, passwords, and running process data that would be lost on shutdown

Answer

RAM contains volatile data—including encryption keys, active process details, and credentials—that is permanently lost when the system powers off.

Question 2

Which ordering correctly reflects the Order of Volatility principle that digital forensic investigators must follow?

Accepted Answer

CPU registers → RAM → Network connections → Hard drive

Answer

The Order of Volatility prioritizes capture from most ephemeral (CPU registers/cache) to least ephemeral (hard drive), ensuring the most transient data is captured first.

Question 3

Which tool is commonly used to acquire a live memory image from a Windows system during a forensic investigation?

Accepted Answer

Magnet RAM Capture (formerly DumpIt)

Answer

Magnet RAM Capture (formerly DumpIt) is a purpose-built tool for capturing a full physical memory image from live Windows systems.

Question 4

In memory forensics, what does the malware technique known as 'process hollowing' involve?

Accepted Answer

Injecting malicious code into a suspended process after unmapping its original memory

Answer

Process hollowing is a code injection technique where a legitimate process is started in suspended state, its memory is unmapped, and replaced with malicious code to evade detection.

Question 5

Which Volatility framework plugin lists all active processes by walking the doubly-linked EPROCESS list in a memory image?

Accepted Answer

volatility pslist

Answer

The `pslist` plugin enumerates running processes by traversing the kernel's doubly-linked EPROCESS list, though it can miss processes hidden via DKOM.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI Memory Forensics & Volatile Data Analysis