Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

A security analyst is conducting live evidence acquisition on a compromised application server following a suspected data exfiltration attempt. The analyst needs to preserve network statistics, system RAM, swap space, and non-volatile storage while minimizing data alteration. According to the standard order of volatility, which of the following evidence types should the analyst acquire FIRST?

  1. Routing table and active network connectionsCevap
  2. B
    Contents of the system swap file and pagefile
  3. C
    Bit-stream disk image of the main partition
  4. D
    Centralized SIEM event log repository

Cevap

Routing table and active network connections must be acquired first because they are the most volatile form of evidence listed.
In digital forensics, the order of volatility governs evidence collection sequence to prevent data loss. According to RFC 3227, highly dynamic system states—such as CPU registers, routing tables, ARP caches, kernel statistics, and active network connections—must be captured before secondary storage like swap space or local hard drives.

Adım Adım Çözüm

1
Identify the volatility level of each evidence source listed in the scenario.
Network state (routing tables, open connections) is extremely fleeting, followed by physical RAM, swap space/temp files, non-volatile disk images, and remote archival logs.
The Order of Volatility principles dictate acquiring evidence starting from the most ephemeral (fastest changing) to the most persistent.
2
Compare the candidate options against the established order of volatility (RFC 3227).
Active network connections and routing tables rank higher in volatility than swap files, physical disk partitions, or remote log repositories.
Network states can disappear instantly if a network interface drops or a socket connection closes.

Anahtar Kavram

Order of Volatility in Digital Forensics
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru