Windows Memory and Artifact Analysis DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner needs to acquire memory from a Windows server that is running a critical database. The server has 128 GB of RAM and is experiencing performance issues. The examiner wants to minimize the impact on the running system while still obtaining a usable memory dump. Which acquisition method should the examiner use?

   • AUse a kernel-mode memory acquisition tool that supports live acquisition with minimal overhead.
   • BUse a hardware-based memory acquisition device that requires rebooting the server.
   • CUse the Windows crash dump feature to force a system crash and capture memory.
   • DUse a remote memory acquisition tool that transfers memory over the network without touching the target.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An investigator is examining a Windows system to determine if a specific executable was run on the machine. The executable is not listed in the Prefetch folder. Which other artifact could provide evidence of program execution?

   • AThe Recycle Bin
   • BThe $MFT file
   • CShimcache (AppCompatCache)
   • DThe Windows event logs
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it important to correlate memory analysis with disk artifacts in a forensic investigation?

   • ATo build a more complete timeline of system activity by combining volatile and non-volatile evidence.
   • BTo prove that the system was not compromised.
   • CTo eliminate the need for disk imaging.
   • DTo ensure that all data is stored in a single location.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic team is investigating a suspected data exfiltration incident. They have a memory dump and a disk image from the compromised Windows system. The memory analysis reveals a process that was communicating with an external IP address, and the disk image shows that a file was deleted around the same time. The team needs to build a timeline of the incident. Which approach is most effective?

   • AExamine only the disk image for deleted files and their timestamps.
   • BUse the Prefetch files to determine which programs were run and when.
   • CCorrelate the memory dump's network connections with the file system's $MFT timestamps and the Security event log.
   • DAnalyze only the memory dump to identify the process and its network connections.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner arrives at a Windows 10 workstation that is suspected of running a credential-stealing malware. The machine is powered on and the user is logged in. The examiner needs to preserve the most volatile data first, while also ensuring the memory dump can later be correlated with disk artifacts. Which action should the examiner take first?

   • ACapture a memory dump using a trusted acquisition tool, then shut down the system and image the disk.
   • BCopy the pagefile.sys file from the running system, then use it as a substitute for a memory dump.
   • CRun a network capture tool to identify command-and-control traffic, then acquire memory after the network capture completes.
   • DShut down the system immediately to prevent malware from spreading, then image the disk and later acquire memory from the image.
   Reveal Solution Discussion Select an answer first