Computer Hacking Forensic Investigator (CHFI v10) — Question 8

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Answer options

• A. Use VMware to be able to capture the data in memory and examine it
• B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
• C. Create a Separate partition of several hundred megabytes and place the swap file there
• D. Use intrusion forensic techniques to study memory resident infections

Correct answer: A

Explanation

The correct answer, A, is effective because VMware allows for live memory capture and analysis without shutting down the system, crucial for volatile data. Options B and C would not effectively capture volatile memory, as they involve altering system memory usage, which may lead to data loss. Option D, while useful in certain contexts, does not directly address the challenge of capturing volatile memory before it is lost.