EnCE Memory Forensics & Volatile Data Analysis 3

Question 1

When performing live memory acquisition, which principle is most important to minimize forensic contamination?

Accepted Answer

Using the smallest possible forensic footprint when running tools on the live system

Answer

Use of a write-blocker on the suspect's hard drive

Answer

Disconnecting the system from the network immediately

Answer

Powering off the system before running any tools

Question 2

Which of the following best describes a 'dump file' (e.g., a Windows minidump or kernel dump) as it relates to memory forensics?

Accepted Answer

A snapshot of part or all of system memory written to disk after a crash or by policy

Answer

A file that stores deleted items from the Recycle Bin

Answer

A log of all network packets captured by Windows

Answer

A backup of the Windows registry created during shutdown

Question 3

In memory forensics, what is the significance of identifying 'orphan' or 'unlinked' processes?

Accepted Answer

They may indicate hidden or malicious processes that have been removed from the normal process list

Answer

They indicate processes that have been legitimately terminated by the user

Answer

They are background services that run without user interaction

Answer

They represent processes that have crashed and are waiting to be restarted

Question 4

Which EnCase feature allows an examiner to run custom scripts to automate the analysis of memory artifacts?

Accepted Answer

EnScript

Answer

EnCase FastBloc

Answer

EnCase SAFE

Answer

EnCase App Central

Question 5

What information can an examiner typically extract from an active network connection found in a memory dump?

Accepted Answer

Source IP, destination IP, port numbers, and the owning process

Answer

The encryption keys used by TLS sessions only

Answer

Only the MAC addresses of communicating devices

Answer

The full content of all transmitted data packets

Question 6

An examiner recovers a memory image and finds that an encryption key for a TrueCrypt volume is present. What does this indicate about the forensic investigation?

Accepted Answer

The encrypted volume was mounted and in use when the memory was captured

Answer

The volume has already been decrypted and saved to disk

Answer

TrueCrypt has been uninstalled from the system

Answer

The key was backed up by the Windows operating system automatically

Question 7

According to best practices in digital forensics (e.g., RFC 3227), what should be documented immediately after acquiring volatile memory?

Accepted Answer

The hash value of the memory image and the date/time of acquisition

Answer

A list of all files on the hard drive

Answer

The suspect's account passwords found in memory

Answer

The output of all running EnScripts