An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS. Which of the…

The correct answer is B. Use a loadable kernel module capture utility, such as LiME. LiME (Linux Memory Extractor) is a Loadable Kernel Module (LKM) designed specifically for acquiring volatile memory on Linux systems. Because it runs within kernel space, it can access all physical memory comprehensively and works with modern Linux kernels. Running dd on…

Enterprise Security Operations

Question

An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS. Which of the following technical approaches would be the MOST feasible way to accomplish this capture?

Options

ARun the memdump utility with the -k flag.
BUse a loadable kernel module capture utility, such as LiME.
CRun dd on/dev/mem.
DEmploy a stand-alone utility, such as FTK Imager.

How the community answered

(51 responses)

A
12% (6)
B
80% (41)
C
4% (2)
D
4% (2)

Explanation

LiME (Linux Memory Extractor) is a Loadable Kernel Module (LKM) designed specifically for acquiring volatile memory on Linux systems. Because it runs within kernel space, it can access all physical memory comprehensively and works with modern Linux kernels. Running dd on /dev/mem is unreliable on recent kernels because kernel hardening (CONFIG_STRICT_DEVMEM) restricts access to /dev/mem. The memdump utility with -k flag is outdated and not supported on recent kernels. FTK Imager is primarily a Windows-based forensic tool and is not practical for live Linux memory acquisition.

Topics

#volatile memory forensics#LiME kernel module#Linux forensics#memory acquisition

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice