GCFA Memory Forensics & Volatile Data Analysis

Question 1

Which Volatility plugin is used to list running processes from a Windows memory image?

Accepted Answer

pslist

Answer

The 'pslist' plugin in Volatility walks the doubly-linked list of EPROCESS structures to enumerate running processes.

Question 2

What is the primary purpose of acquiring a memory dump before shutting down a compromised system?

Accepted Answer

To preserve running process state and volatile artifacts that would be lost on power-off

Answer

Volatile data—running processes, network connections, encryption keys, and injected code—exist only in RAM and are destroyed when power is removed.

Question 3

Which data structure in Windows does Volatility's 'pstree' plugin use to build a parent-child process hierarchy?

Accepted Answer

EPROCESS InheritedFromUniqueProcessId field

Answer

The EPROCESS structure contains InheritedFromUniqueProcessId, which pstree uses to reconstruct parent-child relationships.

Question 4

What technique do rootkits use to hide processes from tools that enumerate the EPROCESS doubly-linked list?

Accepted Answer

DKOM (Direct Kernel Object Manipulation)

Answer

DKOM unlinks a process's EPROCESS structure from the ActiveProcessLinks list, making it invisible to standard enumeration but still present in memory.

Question 5

Which Volatility plugin can detect processes hidden via DKOM by scanning memory for EPROCESS pool tags instead of walking linked lists?

Accepted Answer

psscan

Answer

The 'psscan' plugin uses pool tag scanning to locate EPROCESS structures in memory regardless of whether they are linked in the active process list.

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA - GIAC Certified Forensic Analyst Practice Test

GCFA Memory Forensics & Volatile Data Analysis