ACE ACE Network & Memory Forensics 1 — Questions and Answers
Question 1: What critical data does RAM (volatile memory) analysis reveal that traditional disk forensics cannot?
- Files deleted years before the acquisition
- Running processes, active network connections, encryption keys, and decrypted data in memory (Correct answer)
- File system allocation maps and MFT records
- Registry hive files stored on disk
Correct answer: Running processes, active network connections, encryption keys, and decrypted data in memory
RAM analysis captures the live system state, including running processes, decrypted content, active connections, and data never written to disk.
Question 2: According to the order of volatility, which data source must be collected FIRST at a live scene?
- External hard drive image
- Log files stored on disk
- RAM/memory contents (Correct answer)
- Backup tapes in the server room
Correct answer: RAM/memory contents
RAM is the most volatile data source and must be captured before any other action, as it is destroyed immediately when the system loses power.
Question 3: Which FTK Imager feature is used to acquire a live memory dump from a running Windows system?
- Create Disk Image
- Capture Memory (Correct answer)
- Mount Image to Drive Letter
- Add Evidence Item
Correct answer: Capture Memory
FTK Imager's 'Capture Memory' option acquires the contents of RAM from a running system and writes it to a .mem or .dmp file for offline analysis.
Question 4: What is a forensic memory dump file used for?
- Permanently erasing sensitive files from a drive
- Capturing the contents of RAM at a specific point in time for offline forensic analysis (Correct answer)
- Creating a verified bit-for-bit copy of a hard disk
- Backing up NTFS MFT records
Correct answer: Capturing the contents of RAM at a specific point in time for offline forensic analysis
A memory dump is a snapshot of RAM contents at the moment of acquisition, enabling offline analysis of volatile artifacts that would otherwise be lost.
Question 5: Which Windows registry location stores previously connected wireless (Wi-Fi) network profiles?
- HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
- HKLM\SAM\SAM\Domains\Account\Users
Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs
Windows stores Wi-Fi network history in the NetworkList registry key and WLAN AutoConfig event logs, which can reveal location history based on network associations.
Question 6: What does analyzing DNS artifacts during network forensics help an investigator determine?
- The physical location of a network switch
- Which domain names a system resolved, revealing connections to websites, C2 servers, or exfiltration targets (Correct answer)
- The encryption keys used in SSL/TLS sessions
- The hardware MAC addresses of all devices on a subnet
Correct answer: Which domain names a system resolved, revealing connections to websites, C2 servers, or exfiltration targets
DNS resolution records show which domain names a host looked up, helping establish communications with malicious domains, C2 infrastructure, or unauthorized services.
ACE ACE Network & Memory Forensics 1
What critical data does RAM (volatile memory) analysis reveal that traditional disk forensics cannot?