Examkin

Soru

Zorluk: KolayDigital Forensics and Chain of Custody

An incident responder is preparing to collect digital evidence from a powered-on corporate workstation suspected of compromise. According to standard forensic evidence collection guidelines (Order of Volatility), in what sequence should the responder capture the following components, from MOST volatile to LEAST volatile?

  1. 1CPU registers and processor cache
  2. 2System RAM (Random Access Memory)
  3. 3Pagefile / Swap space on the local drive
  4. 4Off-site archival backup tape

Cevap

The correct sequence from most volatile to least volatile is: CPU registers and processor cache, System RAM (Random Access Memory), Pagefile / Swap space on the local drive, and Off-site archival backup tape.
Digital forensics principles dictate collecting evidence starting with the most fragile, transient data (CPU cache/registers), moving sequentially through dynamic main memory (RAM), temporary disk files (swap/pagefile), and ending with static offline media (archival tapes).

Adım Adım Çözüm

1
Identify the storage locations that lose data almost instantaneously during system execution.
CPU registers and processor cache are prioritized first.
Processor registers and cache change constantly with every instruction cycle and are the most transient data sources.
2
Identify active main memory components that require continuous power.
System RAM is placed second.
Main physical RAM holds active network connections and process structures that disappear upon power loss.
3
Identify temporary virtual memory artifacts stored on persistent media.
Pagefile / Swap space is placed third.
Swap files exist on local hard drives or solid-state drives, making them persistent across reboots despite holding temporary memory structures.
4
Identify long-term static archival media.
Off-site archival backup tape is placed last as the least volatile.
Offline backup media retains data persistently over years without requiring power or active system interaction.

Anahtar Kavram

Order of Volatility in Digital Forensics
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru