Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

A incident response analyst is performing evidence collection on a live enterprise server following an intrusion alert. According to the Order of Volatility standard, in what sequence should the analyst acquire the evidence sources, ordered from most volatile to least volatile?

  1. 1CPU registers and L1/L2 cache memory
  2. 2System RAM and active ARP routing tables
  3. 3Local solid-state persistent disk storage
  4. 4Off-site archival backup tapes

Cevap

The correct sequence from most volatile to least volatile is: CPU registers and L1/L2 cache memory, followed by System RAM and active ARP routing tables, then Local solid-state persistent disk storage, and lastly Off-site archival backup tapes.
Forensic evidence acquisition follows RFC 3227 Order of Volatility: CPU registers and cache (most volatile) -> System RAM and network cache -> Local persistent disk storage -> Off-site archival backup tapes (least volatile).

Adım Adım Çözüm

1
Assess the volatility of processor-level data structures.
CPU registers and caches change at nanosecond speeds and clear immediately upon CPU halt.
Processor memory represents the highest volatility tier in digital forensics.
2
Assess the volatility of main memory and active state information.
System RAM and ARP/routing caches hold volatile dynamic runtime data.
This data remains intact only while power is continuously supplied to the host.
3
Assess the volatility of local secondary storage media.
Local SSD and magnetic drives hold non-volatile data files.
Disk contents persist on physical media even after host power is removed.
4
Assess the volatility of offline long-term archives.
Archival backup tapes contain static snapshot data.
Offline backup media changes least frequently and retains data indefinitely.

Anahtar Kavram

Order of Volatility (RFC 3227)
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru