What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024

The correct answer is C. Copy the running memory to a file. The dd command copies data block by block. Here: 'if=/dev/mem' specifies the input file as /dev/mem, which is a Linux character device representing the system's physical memory (RAM). 'of=/home/sam/mem.bin' is the output file. 'bs=1024' sets the block size to 1024 bytes. The…

Submitted by hans_de· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ACopy the master boot record to a file
BCopy the contents of the system folder em?to a fileCopy the contents of the system folder ?em?to
CCopy the running memory to a file
DCopy the memory dump file to an image file

How the community answered

(44 responses)

B
2% (1)
C
93% (41)
D
5% (2)

Explanation

The dd command copies data block by block. Here: 'if=/dev/mem' specifies the input file as /dev/mem, which is a Linux character device representing the system's physical memory (RAM). 'of=/home/sam/mem.bin' is the output file. 'bs=1024' sets the block size to 1024 bytes. The result is a raw binary dump of the running system memory saved to a file - a live memory acquisition technique used in digital forensics and incident response to capture volatile data such as running processes, encryption keys, and network connections.

Topics

#Linux commands#memory acquisition#dd utility#/dev/mem

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice