As part of incident response, a technician is taking an image of a compromised system and copying the image to a remote image server (192.168.45.82). The system drive is very large but does not…

Question

Options

• Atar cvf - / | ssh 192.168.45.82 "cat - > /images/image.tar"
• Bdd if=/dev/mem | scp - 192.168.45.82:/images/image.dd
• Cmemdump /dev/sda1 | nc 192.168.45.82 3000
• Ddd if=/dev/sda | nc 192.168.45.82 3000

• A
  10% (2)
• B
  24% (5)
• C
  5% (1)
• D
  62% (13)

Explanation

The constraints are: large drive, limited time, non-sensitive data, target is a remote server. dd if=/dev/sda creates a raw, bit-for-bit image of the entire physical disk (not just a partition). Piping to nc (netcat) sends the data over the network without any encryption overhead, which is the fastest possible transfer method. Since the data is explicitly stated to be non-sensitive, the lack of encryption is acceptable and justified by the time constraint. Option A uses tar (unsuitable for raw disk images) and SSH encryption (overhead). Option B reads from /dev/mem (system RAM, not disk) and uses scp (encryption overhead). Option C uses memdump (memory capture tool, wrong source) and targets a partition (/dev/sda1) rather than the full disk. Only D captures the right source (/dev/sda = full disk) via the fastest transport (unencrypted netcat).

No community discussion yet for this question.