EnCE Memory Forensics & Volatile Data Analysis 2

Question 1

Where is the Windows hibernation file (hiberfil.sys) located on a Windows system?

Accepted Answer

C:\ (root of the system drive)

Answer

The hiberfil.sys file resides in the root of the system drive (typically C:\) and is a protected system file.

Question 2

An examiner discovers a pagefile.sys on a seized hard drive. What forensic value does this file have?

Accepted Answer

It may contain fragments of data that were previously in RAM

Answer

The Windows page file (pagefile.sys) is used as virtual memory and can contain data that was paged out of RAM, including plaintext passwords, file fragments, and process data.

Question 3

Which of the following volatile data items has the HIGHEST order of volatility and should be collected first?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache have the highest order of volatility per RFC 3227 guidelines and change constantly, requiring collection before any other volatile data.

Question 4

In EnCase, what is the purpose of acquiring a memory image using the 'servlet' approach on a remote system?

Accepted Answer

To capture RAM from a remote live system without physical access

Answer

The EnCase servlet (ENBD or similar) allows remote live acquisition of a system's RAM over the network, enabling memory collection without physical access to the machine.

Question 5

Which Windows system file can be analyzed in EnCase to recover passwords that were cached in memory?

Accepted Answer

hiberfil.sys

Answer

The hiberfil.sys file contains a snapshot of RAM, which can include cached plaintext or hashed credentials that were loaded in memory at the time of hibernation.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Memory Forensics & Volatile Data Analysis 2