English
Menu

Cyber Attacks and Defense in Practice

Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?

  1. AMemory contents and the state of current network connections → disk contents → backups and archives stored externally
  2. BBackups and archives stored externally → disk contents → memory contents and the state of current network connections
  3. CDisk contents → after powering off, memory contents and the state of current network connections → backups stored externally
Show answer and explanation

Answer: A. Memory contents and the state of current network connections → disk contents → backups and archives stored externally

RFC 3227 (2002), a guideline for collecting evidence in digital forensics, recommends collecting the most easily lost data first. CPU registers and caches, memory contents, running processes and the state of network connections are lost over time or when the power is turned off, so they are collected first. Memory may contain malware that leaves nothing on disk, or information in decrypted form. Disk contents are copied and examined afterwards, and backups and archives stored externally change little, so they can come last.

  • A. Correct. Collect the easily lost memory and network state first.
  • B. Collecting the least volatile data first lets evidence such as memory contents be lost in the meantime.
  • C. Powering off destroys the memory contents and the connection state.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?
  2. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?
  3. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?
  4. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?
  5. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?

Comparisons in this topic