CDFI Memory Forensics & Volatile Data Analysis

Question 1

What is the primary purpose of acquiring volatile memory (RAM) during a digital forensics investigation?

Accepted Answer

To preserve encryption keys, passwords, and running process data that would be lost on shutdown

Answer

To create a forensic backup of the hard drive contents

Answer

To analyze stored network traffic logs from the past 30 days

Answer

To recover deleted files from unallocated filesystem clusters

Question 2

Which ordering correctly reflects the Order of Volatility principle that digital forensic investigators must follow?

Accepted Answer

CPU registers → RAM → Network connections → Hard drive

Answer

Hard drive → RAM → CPU registers → Network connections

Answer

Network connections → CPU registers → RAM → Hard drive

Answer

RAM → CPU registers → Hard drive → Network connections

Question 3

Which tool is commonly used to acquire a live memory image from a Windows system during a forensic investigation?

Accepted Answer

Magnet RAM Capture (formerly DumpIt)

Answer

Autopsy Browser

Answer

WinHex Sector Editor

Answer

Wireshark Packet Analyzer

Question 4

In memory forensics, what does the malware technique known as 'process hollowing' involve?

Accepted Answer

Injecting malicious code into a suspended process after unmapping its original memory

Answer

A legitimate Windows process consuming excessive RAM resources

Answer

Compressing idle process memory to free up available RAM

Answer

Encrypting process memory to prevent forensic extraction

Question 5

Which Volatility framework plugin lists all active processes by walking the doubly-linked EPROCESS list in a memory image?

Accepted Answer

volatility pslist

Answer

volatility imageinfo

Answer

volatility filescan

Answer

volatility netscan

Question 6

What is a 'memory smear' and why is it a concern during forensic memory acquisition?

Accepted Answer

Temporal inconsistency in a memory dump caused by system activity occurring during capture

Answer

A type of malware that actively corrupts RAM contents during acquisition

Answer

A technique malware uses to hide data in unused memory regions

Answer

A compression artifact introduced when converting raw memory to an image file

Question 7

Which Windows system file contains a compressed copy of physical memory that can be analyzed as a forensic artifact without live acquisition?

Accepted Answer

hiberfil.sys

Answer

pagefile.sys

Answer

ntoskrnl.exe

Answer

SYSTEM registry hive