Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A responder must acquire RAM from a macOS system. Which tool is specifically designed for this task and is commonly used in forensic practice?

   • AOSXPmem
   • BLiME
   • CWinPmem
   • DFTK Imager
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After acquiring a memory image and OS artifacts, what documentation is essential for maintaining chain of custody?

   • AA list of all files on the suspect's desktop.
   • BThe make and model of the suspect's keyboard.
   • CThe IP address of the forensic workstation used.
   • DA log of every person who handled the evidence, with timestamps and purpose.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a characteristic of software-based RAM acquisition?

   • AIt runs on the target system and may alter the memory being acquired.
   • BIt always produces a complete and forensically sound image without any risk of corruption.
   • CIt requires specialized hardware that must be installed before the incident.
   • DIt is the only method that can capture memory from a system that is powered off.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   During a live forensic response, you have limited time before the system must be returned to production. Which combination of evidence collection best balances the order of volatility with the time constraint?

   • AImage the entire hard drive first, then capture RAM.
   • BCapture RAM, record network connections, and copy the most recent event logs.
   • CCollect registry hives, then RAM, then network connections.
   • DCopy all user files, then capture RAM.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement correctly distinguishes hardware-based RAM acquisition from software-based RAM acquisition?

   • AHardware-based acquisition requires the target system to be powered off, while software-based acquisition works on a live system.
   • BSoftware-based acquisition is the only method that preserves the exact order of memory pages.
   • CHardware-based acquisition is always faster than software-based acquisition because it bypasses the CPU.
   • DHardware-based acquisition uses a dedicated device to read memory directly, while software-based acquisition relies on the operating system to access memory.
   Reveal Solution Discussion Select an answer first