EnCE Memory Forensics & Volatile Data Analysis

Question 1

Which type of data is lost when a computer is powered off and is therefore considered volatile?

Accepted Answer

Contents of the RAM

Answer

Data stored on the hard drive

Answer

Data stored on a USB drive

Answer

Contents of the BIOS

Question 2

In EnCase, which feature is used to acquire a live memory image from a running Windows system?

Accepted Answer

EnCase Physical Memory Acquisition

Answer

EnCase FastBloc

Answer

EnCase Forensic Imager

Answer

EnCase Servlet

Question 3

What is the primary reason an examiner should acquire volatile data before shutting down a suspect's computer?

Accepted Answer

To capture running processes, network connections, and encryption keys

Answer

To avoid damaging the hard drive

Answer

To prevent the suspect from deleting files

Answer

To comply with chain of custody requirements

Question 4

Which of the following artifacts can typically be found in a memory dump but NOT on the hard drive?

Accepted Answer

Decrypted BitLocker volume keys

Answer

Deleted browser history

Answer

Unallocated file clusters

Answer

Windows registry hives

Question 5

What file extension does EnCase typically use for a captured physical memory image?

Accepted Answer

.E01

Answer

.mem

Answer

.vmem

Answer

.RAM

Question 6

When analyzing a memory dump, which data structure is most useful for identifying currently running processes?

Accepted Answer

EPROCESS linked list

Answer

Master File Table (MFT)

Answer

Process Environment Block (PEB)

Answer

Virtual Address Descriptor (VAD)

Question 7

Which of the following best describes a 'hibernation file' in the context of memory forensics?

Accepted Answer

A compressed snapshot of RAM written to disk when the system hibernates

Answer

A log of failed login attempts

Answer

A backup of the Windows registry

Answer

A record of recently accessed files