An incident response analyst is investigating a compromise on a application server within an organization. The analyst identifies an anomalous process that is executing and maintaining a persistent…

Question

Options

• ACapture running memory
• BCreate a BitCopy of the hard disk
• CUse no to conduct banner grabbing on the remote IP
• DReview /var/log/* for anomalous entries

• A
  79% (31)
• B
  5% (2)
• C
  10% (4)
• D
  5% (2)

Explanation

Digital forensics follows the order of volatility principle: collect the most volatile evidence first before it is lost. RAM (running memory) is the most volatile artifact-it is lost the moment the process terminates or the system is rebooted. Capturing running memory (A) preserves the full state of the anomalous process, including its code, decrypted strings, open handles, network socket details, and any injected payloads that may not exist on disk. A hard disk BitCopy (B) is important but comes after memory capture in the order of volatility. Banner grabbing the remote IP (C) could alert the attacker to the investigation and compromises operational security. Reviewing logs in /var/log (D) is useful but logs are less volatile than RAM and may not contain details about an in-memory process that has evaded logging. Capturing memory first preserves the richest forensic evidence about the live attack.

No community discussion yet for this question.