Live and RAM Forensics

Question 1

What does the RAM contain that might be of interest to a forensic examiner?

Answer 1

• Encryption keys
• Passwords
• Email addresses and other recently typed information
• Loaded program code
• Open network connections
• Running processes

Question 2

Name two RAM architectures

Answer 2

• Stack : fast, hold temporary (local) variables, deallocated after function execution
• Heap : Slower than stack, programmable, global variables, deallocated at quit or by code

Question 3

What problems might occur in terms of anti-forensics?

Answer 3

• Full disk encryption
• FDE + non-root system
• Steganography
• Data wiping
• Data hiding

Question 4

What is the Order of Volatility?

Answer 4

While working with live forensics, you need to “work your way from the volatile to the less volatile.”

like. .
- Registers, cache
- Routing table, process table, memory
- Disk
- Remote logging and monitoring data
- Physical configuration, network topology
- Archival data