Examkin

Soru

Zorluk: ZorDigital Forensics and Chain of Custody

Following an security alert indicating active LSASS memory injection on a Windows Domain Controller, an incident investigator needs to collect digital evidence from the running system. To strictly adhere to the order of volatility and maintain evidence integrity, which of the following actions should the investigator perform FIRST?

  1. Dump physical RAM to an external destination and immediately generate a cryptographic hash of the captured memory fileCevap
  2. B
    Power down the Domain Controller to freeze system state before acquiring a bit-stream forensic image of the main disk drive
  3. C
    Copy the system pagefile.sys and swap files to secondary storage prior to performing any live memory capture
  4. D
    Generate a digital signature for the Master File Table using the server's private key to ensure non-repudiation before memory dump

Cevap

The investigator should dump physical RAM to an external destination and immediately generate a cryptographic hash of the captured memory file.
In digital forensics, evidence must be collected in sequence from most volatile to least volatile (Order of Volatility: CPU registers/cache -> RAM -> network state -> disk -> archival media). Physical RAM contains transient evidence of active attacks such as LSASS memory injection. Capturing RAM while the system is running and calculating an immediate cryptographic hash ensures evidence preservation and verifies chain of custody integrity.

Adım Adım Çözüm

1
Identify the volatility level of evidence sources on the target system.
Physical RAM (live memory) is higher on the order of volatility than disk swap files, system disk images, or static logs.
According to the Order of Volatility (RFC 3227), most volatile evidence must be collected first before it is lost due to power changes or system activity.
2
Acquire the live physical memory without altering system power state.
Live injection payloads and credentials stored in RAM are successfully captured.
Shutting down or rebooting the server would instantly erase RAM contents.
3
Compute a cryptographic hash (e.g., SHA-256) of the acquired memory image file.
A baseline hash is established for the chain of custody log.
Cryptographic hashing proves evidence integrity and ensures that collected data remains unaltered throughout legal and forensic proceedings.

Anahtar Kavram

Order of Volatility and Chain of Custody Integrity Verification
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru