Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

An incident responder arrives at a compromised live workstation suspected of running volatile in-memory malware. To preserve digital evidence without destroying transient data, the responder must extract system artifacts in strict adherence to the forensic Order of Volatility (RFC 3227). In what sequence should the analyst collect the following evidence items, starting with the MOST volatile artifact (collected first) and ending with the LEAST volatile artifact (collected last)?

  1. 1CPU registers and cache contents
  2. 2System RAM and active network socket tables
  3. 3Swap file and pagefile contents on the local drive
  4. 4Bit-stream image of the local secondary storage drive
  5. 5Off-site archival backup tapes

Answer

The correct order of collection from most volatile to least volatile is: CPU registers and cache contents, System RAM and active network socket tables, Swap file and pagefile contents on the local drive, Bit-stream image of the local secondary storage drive, and Off-site archival backup tapes.
Digital forensics standards (RFC 3227) mandate collecting evidence in order of lifetime volatility: CPU cache and registers change constantly (nanoseconds), System RAM and active network connections are cleared upon power-down (seconds to minutes), temporary swap/pagefiles retain paged data on disk, non-volatile local disk partitions persist across power cycles, and offline archival backup tapes remain stable over long periods.

Step-by-Step Solution

1
Identify the most transient artifacts that change within nanoseconds.
CPU registers and cache contents must be acquired first because any processor instruction or context switch instantly overwrites this state.
Top tier of volatility per RFC 3227.
2
Capture main memory and running kernel state before rebooting or modifying system state.
System RAM and active network socket tables are extracted using live acquisition tools before any changes to operating system processes occur.
Volatile system memory loses all data upon host shutdown.
3
Extract temporary memory paging files stored on disk.
Swap files and pagefiles are collected next, as they contain remnants of volatile RAM swapped to disk during system operations.
Transient storage bridges the gap between dynamic RAM and static disk contents.
4
Perform bit-stream disk acquisition of non-volatile local drives.
A forensic duplicate of the secondary storage drive is imaged using a hardware write-blocker.
Non-volatile storage persists through power cycles and is captured after all live volatile memory artifacts.
5
Identify persistent offline and long-term archival evidence.
Off-site archival backup tapes are cataloged and secured last.
Offline backup media is highly static and has the lowest risk of immediate volatility or decay.

Key Concept

Order of Volatility (RFC 3227)
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic