In a situation where data is to be recovered from an attacker's location, which of the following are the FIRST things to capture? (Select TWO).

The correct answer is C. Snapshots of data on the monitor E. Volatile system memory. An exact copy of the attacker's system must be captured for further investigation so that the original data can remain unchanged. An analyst will then start the process of capturing data from the most volatile to the least volatile. The order of volatility from most volatile to…

Enterprise Security Operations

Question

Options

ARemovable media
BPasswords written on scrap paper
CSnapshots of data on the monitor
DDocuments on the printer
EVolatile system memory
FSystem hard drive

How the community answered

(55 responses)

B
2% (1)
C
89% (49)
D
5% (3)
F
4% (2)

Explanation

An exact copy of the attacker's system must be captured for further investigation so that the original data can remain unchanged. An analyst will then start the process of capturing data from the most volatile to the least volatile. The order of volatility from most volatile to least volatile is as Data in RAM, including CPU cache and recently used data and applications Data in RAM, including system and network processes Swap files (also known as paging files) stored on local disk drives Data stored on local disk drives Logs stored on remote systems

Topics

#digital forensics#order of volatility#volatile memory#evidence collection

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice