EnCE Memory Forensics & Volatile Data Analysis 1 — Questions and Answers
Question 1: Which type of data is lost when a computer is powered off and is therefore considered volatile?
- Contents of the RAM (Correct answer)
- Data stored on the hard drive
- Data stored on a USB drive
- Contents of the BIOS
Correct answer: Contents of the RAM
RAM (Random Access Memory) is volatile storage, meaning its contents are lost when power is removed from the system.
Question 2: In EnCase, which feature is used to acquire a live memory image from a running Windows system?
- EnCase FastBloc
- EnCase Physical Memory Acquisition (Correct answer)
- EnCase Forensic Imager
- EnCase Servlet
Correct answer: EnCase Physical Memory Acquisition
EnCase Physical Memory Acquisition allows examiners to capture a snapshot of RAM from a live running Windows system.
Question 3: What is the primary reason an examiner should acquire volatile data before shutting down a suspect's computer?
- To avoid damaging the hard drive
- To capture running processes, network connections, and encryption keys (Correct answer)
- To prevent the suspect from deleting files
- To comply with chain of custody requirements
Correct answer: To capture running processes, network connections, and encryption keys
Volatile data such as active processes, open network connections, logged-in users, and encryption keys only exist in RAM and are lost on shutdown.
Question 4: Which of the following artifacts can typically be found in a memory dump but NOT on the hard drive?
- Deleted browser history
- Decrypted BitLocker volume keys (Correct answer)
- Unallocated file clusters
- Windows registry hives
Correct answer: Decrypted BitLocker volume keys
BitLocker encryption keys are held in RAM while the volume is mounted and decrypted, but are never stored on disk in plaintext.
Question 5: What file extension does EnCase typically use for a captured physical memory image?
- .mem
- .vmem
- .E01 (Correct answer)
- .RAM
Correct answer: .E01
EnCase stores acquired memory images in the Expert Witness Format (.E01), the same container used for disk images.
Question 6: When analyzing a memory dump, which data structure is most useful for identifying currently running processes?
- Master File Table (MFT)
- Process Environment Block (PEB)
- EPROCESS linked list (Correct answer)
- Virtual Address Descriptor (VAD)
Correct answer: EPROCESS linked list
The EPROCESS linked list in Windows kernel memory chains all active process control blocks together, making it the primary structure for enumerating running processes.
Question 7: Which of the following best describes a 'hibernation file' in the context of memory forensics?
- A log of failed login attempts
- A compressed snapshot of RAM written to disk when the system hibernates (Correct answer)
- A backup of the Windows registry
- A record of recently accessed files
Correct answer: A compressed snapshot of RAM written to disk when the system hibernates
The Windows hibernation file (hiberfil.sys) contains a compressed copy of the entire contents of RAM at the time hibernation was initiated, making it valuable for memory analysis.
EnCE Memory Forensics & Volatile Data Analysis 1
Which type of data is lost when a computer is powered off and is therefore considered volatile?