EC-Council
312-49V9 · Question #288
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In…
The correct answer is A. Use Vmware to be able to capture the data in memory and examine it C. Create a Separate partition of several hundred megabytes and place the swap file there. See the full explanation below for the reasoning.
Question
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Options
- AUse Vmware to be able to capture the data in memory and examine it
- BGive the Operating System a minimal amount of memory, forcing it to use a swap file
- CCreate a Separate partition of several hundred megabytes and place the swap file there
- DUse intrusion forensic techniques to study memory resident infections
How the community answered
(26 responses)- A81% (21)
- B4% (1)
- D15% (4)
Community Discussion
No community discussion yet for this question.