Examkin

Question

Difficulty: Very hardDigital Forensics and Chain of Custody

An incident response investigator is tasked with preserving forensic evidence from a live high-frequency trading server that was compromised during an active cyber intrusion. The server is currently powered on and running critical processes in memory. To ensure that digital evidence is collected without destroying highly transient artifact state in compliance with RFC 3227 guidelines, in what sequence should the investigator acquire the artifacts from most volatile to least volatile?

  1. 1CPU registers, level 1/level 2 cache contents, and execution pipeline state
  2. 2System RAM, kernel routing tables, process tables, and active ARP cache
  3. 3Temporary file systems, operating system swap files, and pagefiles
  4. 4Local NVMe storage drives and attached non-volatile bit-stream disk volumes
  5. 5Offsite archival tape backups and optical cold-storage media

Answer

The correct acquisition order from most volatile to least volatile is: CPU registers and cache → System RAM and active network state → Swap files and temporary file systems → Local NVMe drives and non-volatile disk volumes → Offsite archival tape backups.
Digital evidence collection must strictly follow RFC 3227 guidelines starting with the shortest lifespan items to prevent evidence destruction. CPU registers and caches alter state in nanoseconds and are lost first, followed by volatile system memory (RAM and active network caches), swap/page files on storage drives, non-volatile local disk storage, and finally offline archival backup tapes.

Step-by-Step Solution

1
Identify the most volatile hardware components.
CPU registers, L1/L2 caches, and pipeline states are identified as changing on a nanosecond scale.
According to RFC 3227, processor-level memory is lost almost instantaneously upon state change or interruption.
2
Locate volatile volatile system memory and transient OS tables.
System RAM, ARP cache, routing tables, and process memory are placed immediately after CPU cache.
Physical RAM and active network structures cleared upon power-down represent the primary target for live memory analysis.
3
Sequence secondary dynamic disk structures.
Pagefiles, swap space, and temporary file systems are placed after physical RAM.
Swap space resides on disk but changes rapidly during system execution, persisting longer than physical RAM but changing faster than static disk files.
4
Capture static non-volatile primary storage media.
Local NVMe storage volumes and bit-stream disk images are sequenced after temporary/swap storage.
Persistent local storage retains data across reboots and power outages.
5
Place long-term offline media at the end of the sequence.
Offsite archival tape backups and optical media are established as the least volatile evidence.
Offline backup media is immutable and disconnected from active host execution.

Key Concept

RFC 3227 Order of Volatility
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic