312-49 · Question #512
Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?
The correct answer is A. Swap space. Swap space (also called a page file or swap partition) is disk space used by the OS as an extension of RAM. When physical RAM is full, the OS pages out inactive process memory to swap space. Therefore, swap space can contain memory contents of running or recently running…
Question
Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?
Options
- ASwap space
- BApplication data
- CFiles and documents
- DSlack space
How the community answered
(36 responses)- A86% (31)
- B8% (3)
- C3% (1)
- D3% (1)
Explanation
Swap space (also called a page file or swap partition) is disk space used by the OS as an extension of RAM. When physical RAM is full, the OS pages out inactive process memory to swap space. Therefore, swap space can contain memory contents of running or recently running processes, including process state, stack data, and fragments of sensitive data. A forensic investigator examining running processes must check RAM, virtual memory, AND swap space to get a complete picture. Slack space is unused space within file clusters. Application data and files/documents are not primary sources for live process information.
Topics
Community Discussion
No community discussion yet for this question.