GCFA Memory Forensics & Volatile Data Analysis 2

Question 1

What information can be extracted from the Windows hibernation file (hiberfil.sys) for forensic purposes?

Accepted Answer

A compressed snapshot of physical RAM at the time of hibernation

Answer

Only file system metadata

Answer

Only user account hashes

Answer

Browser history and cookies exclusively

Question 2

Which Volatility plugin extracts command-line arguments for each running process from a memory image?

Accepted Answer

cmdline

Answer

cmdscan

Answer

consoles

Answer

shellbags

Question 3

When analyzing a Windows memory image, which plugin would reveal recently executed console commands typed into cmd.exe?

Accepted Answer

cmdscan

Answer

cmdline

Answer

pslist

Answer

handles

Question 4

What is the significance of the 'malfind' plugin output in a Volatility analysis?

Accepted Answer

It identifies memory regions with suspicious protections (e.g., RWX) and MZ headers not backed by a disk file

Answer

It lists all malware signatures from an AV database

Answer

It finds files with malicious extensions in the file system

Answer

It scans registry hives for persistence keys

Question 5

In the order of volatility defined by RFC 3227, which data source should be collected FIRST during live response?

Accepted Answer

Registers, cache, and running processes in RAM

Answer

Swap/page files

Answer

Temporary file system data

Answer

Remote logging and monitoring data

Question 6

Which tool is commonly used on Linux systems to acquire a live memory image without requiring a kernel module?

Accepted Answer

LiME (Linux Memory Extractor)

Answer

dd if=/dev/mem

Answer

Rekall

Answer

Memdump

Question 7

What is 'process hollowing' and how can it be detected during memory forensic analysis?

Accepted Answer

A technique where a legitimate process's code is replaced in memory with malicious code; detected by comparing the on-disk image to in-memory content

Answer

A technique where a process is paused; detected by checking CPU state

Answer

A technique to hollow out log files; detected by examining file metadata

Answer

A technique to remove DLLs from a process; detected by listing loaded modules