GCFA Memory Forensics & Volatile Data Analysis 2

Question 1

What information can be extracted from the Windows hibernation file (hiberfil.sys) for forensic purposes?

Accepted Answer

A compressed snapshot of physical RAM at the time of hibernation

Answer

hiberfil.sys contains a compressed copy of physical RAM saved when the system hibernates, allowing analysts to recover volatile data after the system is powered off.

Question 2

Which Volatility plugin extracts command-line arguments for each running process from a memory image?

Accepted Answer

cmdline

Answer

The 'cmdline' plugin reads the PEB (Process Environment Block) of each process to retrieve the full command-line string used to launch it.

Question 3

When analyzing a Windows memory image, which plugin would reveal recently executed console commands typed into cmd.exe?

Accepted Answer

cmdscan

Answer

The 'cmdscan' plugin scans for COMMAND_HISTORY structures used by csrss.exe to record commands typed in console windows.

Question 4

What is the significance of the 'malfind' plugin output in a Volatility analysis?

Accepted Answer

It identifies memory regions with suspicious protections (e.g., RWX) and MZ headers not backed by a disk file

Answer

Malfind flags private, executable memory regions that contain PE headers (MZ signature) but are not associated with a mapped file, indicating potential code injection or reflective DLL loading.

Question 5

In the order of volatility defined by RFC 3227, which data source should be collected FIRST during live response?

Accepted Answer

Registers, cache, and running processes in RAM

Answer

RFC 3227 orders collection from most to least volatile; CPU registers, cache, and running process memory are the most ephemeral and must be captured first.

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA Memory Forensics & Volatile Data Analysis 2