A forensic analyst is responding to an active security incident involving a bare-metal hypervisor suspected of hosting a sophisticated, memory-resident kernel rootkit that utilizes Direct Memory Access (DMA) to exfiltrate cryptographic keys. To preserve evidence for potential judicial proceedings while adhering strictly to forensic standards, which of the following actions should the analyst perform FIRST?
- AGracefully shut down the hypervisor operating system to preserve host disk state, then create a forensic bit-stream image of the local boot drive using a hardware write-blocker.
- Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.Cevap
- CGenerate SHA-256 cryptographic hashes of all static virtual disk images stored on the local storage array to legally establish non-repudiation for the contents of volatile system memory.
- DExport hypervisor snapshot configuration files directly over an unencrypted live network socket to a centralized SIEM repository to maintain unbroken chain of custody.
Cevap
Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.
The correct action is to acquire system RAM live using a validated hardware or kernel acquisition method writing directly to local write-blocked media. System memory (RAM) is near the top of the Order of Volatility. Because memory-resident rootkits exist primarily in volatile memory, any alteration of system power states (such as a system shutdown) destroys the primary evidence.
Adım Adım Çözüm
Anahtar Kavram
Order of Volatility and Volatile Memory Acquisition
Tahmini Süre:3m 0s