EnCE Memory Forensics & Volatile Data Analysis 2

Question 1

Where is the Windows hibernation file (hiberfil.sys) located on a Windows system?

Accepted Answer

C:\ (root of the system drive)

Answer

C:\Windows\System32\

Answer

C:\Users\<username>\

Answer

C:\Windows\Temp\

Question 2

An examiner discovers a pagefile.sys on a seized hard drive. What forensic value does this file have?

Accepted Answer

It may contain fragments of data that were previously in RAM

Answer

It contains a list of recently installed programs

Answer

It stores the system's network configuration

Answer

It logs all user login and logout events

Question 3

Which of the following volatile data items has the HIGHEST order of volatility and should be collected first?

Accepted Answer

CPU registers and cache

Answer

Contents of pagefile.sys

Answer

System time and clock skew

Answer

Temporary file system data

Question 4

In EnCase, what is the purpose of acquiring a memory image using the 'servlet' approach on a remote system?

Accepted Answer

To capture RAM from a remote live system without physical access

Answer

To image the remote system's hard drive over the network

Answer

To install EnCase permanently on the remote machine

Answer

To create a virtual machine clone of the remote system

Question 5

Which Windows system file can be analyzed in EnCase to recover passwords that were cached in memory?

Accepted Answer

hiberfil.sys

Answer

SAM hive

Answer

ntuser.dat

Answer

SYSTEM hive

Question 6

What does the term 'smear' refer to in the context of memory acquisition?

Accepted Answer

Inconsistencies in a memory image caused by changes in RAM during acquisition

Answer

Contamination of the hard drive during imaging

Answer

A method to overwrite sensitive data before imaging

Answer

A type of malware that corrupts memory dumps

Question 7

Which of the following is a common method used by malware to hide itself in a memory dump (a technique called process hollowing)?

Accepted Answer

Replacing the code of a legitimate process with malicious code in memory

Answer

Encrypting all files on the hard drive

Answer

Creating a hidden user account in the SAM database

Answer

Modifying the MFT to hide its executable file