Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which piece of information should be documented during the acquisition of a RAM image?

   • AThe brand of the RAM chips
   • BThe exact time and date of the acquisition
   • CThe color of the computer case
   • DThe weather conditions at the time of acquisition
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a live response, you must prioritize evidence collection. Which item should be collected first?

   • AThe registry hives
   • BThe contents of RAM
   • CThe hard drive image
   • DThe system's event logs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A field team is responding to a suspected data exfiltration incident on a Windows 10 workstation. The system is powered on and the user is logged in. The team needs to capture the contents of physical memory before any further user activity. Which approach best preserves the evidentiary value of the volatile data?

   • APerform a clean shutdown, then remove the hard drive and image it with a hardware write blocker.
   • BRun a trusted memory acquisition tool from a write-blocked USB drive and save the image to a forensically clean external drive.
   • CUse the built-in Task Manager to create a memory dump file and copy it to the network share.
   • DCopy the hibernation file from the system drive to an evidence drive, then power off the system.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A responder is using the 'dd' command to acquire RAM from a Linux system. Which limitation of 'dd' is most relevant to memory acquisition?

   • AIt cannot write to an external drive.
   • BIt cannot capture memory that is paged out to swap.
   • CIt cannot acquire memory from a running system.
   • DIt does not compute a hash of the output.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An investigator needs to acquire the Windows Registry hives from a live system to analyze recently executed programs. The system cannot be shut down. Which method preserves the integrity of the registry data while allowing for offline analysis?

   • AReboot the system into a live Linux environment and copy the hive files from the NTFS partition.
   • BCopy the hive files directly from C:\Windows\System32\config while the system is running.
   • CUse a tool like FTK Imager to create a logical image of the entire C: drive.
   • DUse the Windows built-in 'reg save' command to export each hive to an external forensic drive.
   Reveal Solution Discussion Select an answer first