312-49 · Question #218
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf?John is working as a computer forensics investigator for a…
The correct answer is D. Hidden running processes. Virtual memory (the pagefile/swap space) contains data that was recently active in RAM but has been paged out to disk. Scanning virtual memory can reveal hidden or running processes, active network connections, encryption keys, passwords, and other volatile data that would not…
Question
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf?John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce?
Options
- AIt contains the times and dates of when the system was last patched
- BIt is not necessary to scan the virtual memory of a computer
- CIt contains the times and dates of all the system files
- DHidden running processes
How the community answered
(54 responses)- A4% (2)
- C2% (1)
- D94% (51)
Explanation
Virtual memory (the pagefile/swap space) contains data that was recently active in RAM but has been paged out to disk. Scanning virtual memory can reveal hidden or running processes, active network connections, encryption keys, passwords, and other volatile data that would not appear in a standard file system scan. In this scenario, a botnet server might use rootkit techniques to hide its processes from the operating system, but remnants of those processes could still be found in virtual memory. Virtual memory does not reliably store patch history or general file timestamps-those are found in the file system and registry.
Topics
Community Discussion
No community discussion yet for this question.