Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

A cybersecurity analyst is investigating an active fileless malware infection on a host machine operating multiple virtualized enterprise services. The analyst must capture digital evidence in strict compliance with the Order of Volatility while maintaining chain of custody standards for legal admissibility. Which of the following procedures should the analyst execute FIRST?

  1. Capture the host system's volatile physical memory (RAM) over a secure network stream to an external forensic destination before creating VM snapshots or modifying system power states.Answer
  2. B
    Create a hypervisor snapshot of all active virtual machine disk files and calculate their SHA-256 hashes to establish digital non-repudiation for the suspect host.
  3. C
    Immediately disconnect host power to prevent memory tampering, then mount the physical host drive through a hardware write-blocker to generate a bit-stream disk image.
  4. D
    Export network traffic logs and SIEM event streams from remote syslog servers to establish a baseline before examining local system storage devices.

Answer

The analyst should capture the host system's volatile physical memory (RAM) over a secure network stream to an external forensic destination before creating VM snapshots or modifying system power states.
According to the forensic Order of Volatility, volatile data such as CPU registers, cache, and RAM must be collected before less volatile data like hard drives or archived logs. In a live investigation involving fileless malware, capturing system RAM prior to any state change (such as taking snapshots or pulling plug power) ensures that critical volatile evidence is preserved intact.

Step-by-Step Solution

1
Identify the Order of Volatility for digital evidence acquisition.
System memory (RAM), CPU cache, and active network connections are classified as most volatile and must be captured before non-volatile storage or power state changes.
Fileless malware resides entirely within volatile system memory and will be permanently lost if the machine is powered off or modified.
2
Evaluate the impact of hypervisor snapshots or disk imaging prior to memory dump.
Hypervisor snapshots alter physical disk state and write active memory pages to disk files, contaminating the original evidence.
Live memory dumps must occur before disk modifications to maintain forensic purity.
3
Execute volatile memory capture while logging cryptographic hashes for chain of custody.
RAM contents are safely acquired for analysis without destroying transient evidence.
Preserves both evidentiary admissibility and critical malware runtime context.

Key Concept

Order of Volatility and Live Forensic Evidence Acquisition
Estimated Time:2m 0s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic