Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

During an ongoing internal incident investigation, a security analyst suspects that a logged-in workstation is currently running an active malicious process in memory that is exfiltrating sensitive database records to an external server. The system is powered on and connected to the local network. To ensure maximum evidentiary value and legal admissibility for potential prosecution, which of the following actions should the analyst take FIRST?

  1. Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.Answer
  2. B
    Immediately disconnect the power cable to freeze the current disk state and prevent further remote data exfiltration.
  3. C
    Perform a full bit-stream disk clone of the primary storage drive before capturing any system memory artifacts.
  4. D
    Export the system's security event logs to a remote network share to establish non-repudiation of user authentication.

Answer

Capturing the system's volatile memory (RAM) using an approved live acquisition tool before taking any action that modifies the system state.
According to standard digital forensics guidelines and RFC 3227 (Order of Volatility), evidence must be gathered starting from the most volatile items to the least volatile items. Active system memory (RAM) containing execution stacks, network connections, and unencrypted keys is highly perishable and must be preserved prior to powering down or performing disk-level imaging.

Step-by-Step Solution

1
Evaluate the current operational state of the compromised host system.
The target computer is powered on with active processes running in system memory.
Understanding host state determines which artifacts are most volatile and at risk of immediate loss.
2
Apply the Order of Volatility principles to sequence evidence acquisition.
System memory (RAM) and active cache/registers take priority over non-volatile hard disk storage and remote logs.
Volatile data disappears when the device loses power or shuts down, whereas disk data persists across reboots.
3
Execute live memory capture using an authorized forensic acquisition tool.
A cryptographically hashed RAM dump file is preserved for forensic analysis.
This captures the running malicious process, injected code, and active network connections without destroying evidence.

Key Concept

Order of Volatility in Digital Forensics
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic