Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

The correct answer is D. Swap space and page files. Best practices suggest that live response should follow the order of volatility, which means that you want to collect data which is changing the most rapidly. The order of volatility is: Swap or page file Network status and current / recent network connections Running processes

Data Protection and Incident Response

Question

Options

AEvent logs from a central repository
BDirectory listing of system files
CMedia in the CDrom drive
DSwap space and page files

How the community answered

(33 responses)

A
3% (1)
B
6% (2)
C
3% (1)
D
88% (29)

Explanation

Best practices suggest that live response should follow the order of volatility, which means that you want to collect data which is changing the most rapidly. The order of volatility is: Swap or page file Network status and current / recent network connections Running processes

Topics

#order of volatility#swap space#live forensics#volatile data collection

Community Discussion

No community discussion yet for this question.

Full GCED Practice