Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

During a forensic investigation of a compromise on a critical database host, an incident handler needs to collect evidence while the system remains powered on. To minimize data loss, which of the following evidence acquisition steps should be executed FIRST according to the order of volatility?

  1. Dump system RAM and active CPU cache registers.Answer
  2. B
    Acquire a bit-stream physical image of the local SSD system drive.
  3. C
    Power off the host immediately to prevent network data exfiltration.
  4. D
    Generate SHA-256 cryptographic hashes for files to guarantee non-repudiation.

Answer

Dumping system RAM and active CPU cache registers is the correct first step.
Dumping system RAM and active CPU cache registers is correct because the order of volatility requires capturing evidence from the most ephemeral (volatile) sources first. CPU cache, memory registers, and main system RAM lose all contents when power is interrupted or when overwritten by OS operations, whereas local disk drives and archived backups retain data persistently.

Step-by-Step Solution

1
Identify the volatility level of candidate evidence sources on the live database host.
CPU cache, registers, and system RAM are determined to be extremely short-lived volatile data sources.
The order of volatility dictates collecting evidence starting from the most volatile (easily lost) components to the least volatile.
2
Prioritize capture tools to acquire RAM and CPU state prior to persistent storage.
Volatile memory is successfully preserved before any disk writes or power state modifications alter system memory contents.
Interacting with disk storage or shutting down the machine irreversibly modifies running process state and RAM contents.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 30s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic