Week 6 Flashcards
1
Q
What are true forms of data?
A
Unencrypted or unobfuscated data
2
Q
What are examples of memory-only data?
A
Memory resident malware or temporary data (passwords)
3
Q
What is one way to define memory?
A
An array of pages
4
Q
Processes are not assigned pages in physical memory. What are they assigned to?
A
They are assigned to VIRTUAL memory space
5
Q
What is the purpose of ASLR?
A
Address space layout randomisation - making it hard for an attacker to guess the location of important processes
6
Q
What is the forensic purposes of memory analysis?
A
To discover the recent nature of data or the true form of data
7
Q
What is Volatility?
A
A command-line tool for memory analysis
8
Q
A
