Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

During an incident response investigation involving a compromised enterprise database server suspected of running an in-memory fileless payload, a forensic team must preserve digital evidence for potential judicial proceedings. Which of the following procedures should the team perform FIRST to adhere strictly to the order of volatility?

  1. A
    Deploy a hardware write-blocker to acquire a bit-stream forensic image of the primary non-volatile storage drive.
  2. Capture the contents of volatile system memory to external forensic media.Answer
  3. C
    Generate and log cryptographic hashes for all database files directly on the live operating system volume.
  4. D
    Initiate a graceful system shutdown to prevent remote execution and isolate log files on disk.

Answer

Capturing the contents of volatile system memory to external forensic media must be performed first.
Capturing the contents of volatile system memory to external forensic media is the correct action because system RAM ranks higher in the order of volatility than persistent disk drives. In-memory payloads and volatile system states (such as active network sockets and running processes) are completely lost if the system is powered off or modified prior to acquisition.

Step-by-Step Solution

1
Identify the data sources present on the target server and categorize them by volatility level.
System RAM contains highly volatile evidence (in-memory malware, network connections, encryption keys), while solid-state and hard disk drives contain non-volatile persistent evidence.
Forensic evidence acquisition must prioritize sources that are lost most rapidly when system state changes.
2
Apply the standard forensic Order of Volatility principles.
System RAM and CPU registers/cache precede persistent storage media such as hard drives and network shares.
Adhering to the RFC 3227 order of volatility ensures the preservation of transient artifacts before taking actions that alter system memory.
3
Execute memory dump procedures prior to powering off or taking disk images.
Volatile artifacts are saved to isolated, sanitized external media with integrity hashes logged.
This preserves the in-memory fileless payload without inadvertently wiping system memory during a power cycle or disk capture.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 15s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic