During a live data acquisition procedure, forensic investigators are tasked with analyzing a suspected breach of a corporate network. The breach involves unauthorized access to sensitive files…

Question

Options

• APrinter driver versions and configurations
• BCurrent system uptime and DLLs loaded
• COpen connections and routing information
• DMouse click activity and cursor movements

• A
  4% (1)
• B
  19% (5)
• C
  69% (18)
• D
  8% (2)

Explanation

This question directly maps to CHFI v11 objectives under Data Acquisition and Duplication, specifically live data acquisition and the order of volatility. Live forensics is critical when systems cannot be powered down without losing crucial evidence, particularly during active or recent network intrusions. CHFI v11 emphasizes that investigators must prioritize volatile data that can quickly disappear when a system is shut down or network conditions change. Open network connections, active sessions, routing tables, ARP cache, and listening ports provide immediate insight into how an attacker accessed the system, whether lateral movement occurred, and which external or internal IP addresses were involved. Capturing this data helps investigators trace the intrusion's origin, identify command-and-control communications, and uncover misconfigurations or exposed services that enabled the breach.

No community discussion yet for this question.