Computer Hacking Forensic Investigator (CHFI) — Question 123

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Answer options

• A. Use VMware to be able to capture the data in memory and examine it
• B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
• C. Create a Separate partition of several hundred megabytes and place the swap file there
• D. Use intrusion forensic techniques to study memory resident infections

Correct answer: A

Explanation

The correct answer is A, as using VMware allows for the capturing and analysis of volatile memory without the risk of losing data when the system is shut down. Options B and C do not effectively address the issue of capturing volatile memory, as they involve manipulating memory usage rather than preserving it. Option D focuses on studying infections rather than capturing memory, which is not the primary concern in this context.