Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 7)

Questions 31–35

1. 31application · hard

   A forensic team is on-site and must acquire RAM from a server that has no free USB ports and no network access. The server is running a custom Linux kernel. Which acquisition method is most feasible?

   • ALoad a kernel module such as LiME to dump memory to the local disk, then later image the disk.
   • BUse a FireWire/Thunderbolt DMA attack tool to dump memory.
   • CReboot the server into a forensic live CD and use a memory imaging tool.
   • DUse the /proc/kcore file with dd to copy memory to a local file.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An incident responder must collect OS artifacts from a Linux server that is running a critical production database. The server cannot be stopped, and the responder must minimize the impact on the running system. The investigation requires a timeline of file access and user login history. Which combination of acquisition methods BEST meets these requirements?

   • ACopy the entire /var/log directory and the /etc/passwd file to an external drive.
   • BTake a full disk image using 'dd' while the system is running.
   • CUse 'last' to capture login history and 'stat' to record timestamps of key files, saving output to an external drive.
   • DUse 'tcpdump' to capture all network traffic to and from the server.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic team is preparing to acquire memory from a laptop that is in a 'sleep' (S3) state. The team has a hardware write-blocker and a software acquisition tool. The laptop's hard drive is encrypted with BitLocker. What is the MOST appropriate approach to acquire memory and preserve the ability to decrypt the drive?

   • APower on the laptop and boot from a forensic CD to capture memory.
   • BRemove the RAM modules and read them directly using a hardware reader.
   • CWake the laptop from sleep and immediately capture RAM using a software tool.
   • DUse a hardware memory acquisition device that can read RAM while the system is in sleep state.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic examiner must collect OS artifacts from a Linux system that is also a critical production server. The server cannot be taken offline, and the examiner must avoid altering the system as much as possible. Which approach best meets these constraints?

   • AUse 'rsync' to copy specific artifact directories to an external drive, preserving timestamps.
   • BUse 'tar' to archive /etc, /var/log, and user home directories to an external drive.
   • CUse 'dd' to image the entire root partition to an external drive.
   • DCopy files with 'cp' to a USB drive, then run 'sync'.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An incident responder must acquire RAM from a Linux server that is running a critical production workload. The server has 64 GB of RAM and only 20 GB of free disk space on the root filesystem. The responder has a USB drive with 128 GB of free space. Which acquisition method is most appropriate?

   • ASuspend the server to disk and copy the swap partition to the USB drive.
   • BUse the LiME kernel module to dump RAM to the USB drive.
   • CUse /dev/mem with dd to write the image directly to the USB drive.
   • DUse the 'dump' command to create a compressed image in /var/tmp, then copy it to the USB drive.
   Reveal Solution Discussion Select an answer first