EnCE Memory Forensics & Volatile Data Analysis 2 — Questions and Answers
Question 1: Where is the Windows hibernation file (hiberfil.sys) located on a Windows system?
- C:\Windows\System32\
- C:\Users\<username>\
- C:\ (root of the system drive) (Correct answer)
- C:\Windows\Temp\
Correct answer: C:\ (root of the system drive)
The hiberfil.sys file resides in the root of the system drive (typically C:\) and is a protected system file.
Question 2: An examiner discovers a pagefile.sys on a seized hard drive. What forensic value does this file have?
- It contains a list of recently installed programs
- It may contain fragments of data that were previously in RAM (Correct answer)
- It stores the system's network configuration
- It logs all user login and logout events
Correct answer: It may contain fragments of data that were previously in RAM
The Windows page file (pagefile.sys) is used as virtual memory and can contain data that was paged out of RAM, including plaintext passwords, file fragments, and process data.
Question 3: Which of the following volatile data items has the HIGHEST order of volatility and should be collected first?
- Contents of pagefile.sys
- System time and clock skew
- CPU registers and cache (Correct answer)
- Temporary file system data
Correct answer: CPU registers and cache
CPU registers and cache have the highest order of volatility per RFC 3227 guidelines and change constantly, requiring collection before any other volatile data.
Question 4: In EnCase, what is the purpose of acquiring a memory image using the 'servlet' approach on a remote system?
- To image the remote system's hard drive over the network
- To capture RAM from a remote live system without physical access (Correct answer)
- To install EnCase permanently on the remote machine
- To create a virtual machine clone of the remote system
Correct answer: To capture RAM from a remote live system without physical access
The EnCase servlet (ENBD or similar) allows remote live acquisition of a system's RAM over the network, enabling memory collection without physical access to the machine.
Question 5: Which Windows system file can be analyzed in EnCase to recover passwords that were cached in memory?
- SAM hive
- hiberfil.sys (Correct answer)
- ntuser.dat
- SYSTEM hive
Correct answer: hiberfil.sys
The hiberfil.sys file contains a snapshot of RAM, which can include cached plaintext or hashed credentials that were loaded in memory at the time of hibernation.
Question 6: What does the term 'smear' refer to in the context of memory acquisition?
- Contamination of the hard drive during imaging
- Inconsistencies in a memory image caused by changes in RAM during acquisition (Correct answer)
- A method to overwrite sensitive data before imaging
- A type of malware that corrupts memory dumps
Correct answer: Inconsistencies in a memory image caused by changes in RAM during acquisition
Memory smear occurs because RAM contents change continuously during acquisition; the resulting image may contain data from different points in time, creating inconsistencies.
Question 7: Which of the following is a common method used by malware to hide itself in a memory dump (a technique called process hollowing)?
- Encrypting all files on the hard drive
- Replacing the code of a legitimate process with malicious code in memory (Correct answer)
- Creating a hidden user account in the SAM database
- Modifying the MFT to hide its executable file
Correct answer: Replacing the code of a legitimate process with malicious code in memory
Process hollowing involves launching a legitimate process, then replacing its memory space with malicious code, allowing malware to execute under a trusted process name.
EnCE Memory Forensics & Volatile Data Analysis 2
Where is the Windows hibernation file (hiberfil.sys) located on a Windows system?