EnCE Memory Forensics & Volatile Data Analysis 3

Question 1

When performing live memory acquisition, which principle is most important to minimize forensic contamination?

Accepted Answer

Using the smallest possible forensic footprint when running tools on the live system

Answer

Any tool run on a live system will modify some memory; minimizing the footprint (using small, statically compiled tools) reduces contamination and preserves more original evidence.

Question 2

Which of the following best describes a 'dump file' (e.g., a Windows minidump or kernel dump) as it relates to memory forensics?

Accepted Answer

A snapshot of part or all of system memory written to disk after a crash or by policy

Answer

Windows crash dump files (minidump, kernel dump, complete memory dump) contain captured memory data written to disk and can be analyzed for forensic artifacts even without a live memory capture.

Question 3

In memory forensics, what is the significance of identifying 'orphan' or 'unlinked' processes?

Accepted Answer

They may indicate hidden or malicious processes that have been removed from the normal process list

Answer

Malware often unlinks its process from the EPROCESS list to avoid detection by standard tools, making orphaned processes a strong indicator of compromise that can be found through direct memory scanning.

Question 4

Which EnCase feature allows an examiner to run custom scripts to automate the analysis of memory artifacts?

Accepted Answer

EnScript

Answer

EnScript is EnCase's built-in scripting language and IDE that allows examiners to write custom scripts to automate evidence processing, including memory artifact analysis.

Question 5

What information can an examiner typically extract from an active network connection found in a memory dump?

Accepted Answer

Source IP, destination IP, port numbers, and the owning process

Answer

Network connection data structures in memory contain source/destination IPs, ports, connection state, and the PID of the owning process, providing context for active communications at the time of acquisition.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Memory Forensics & Volatile Data Analysis 3