Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if Use VMware to be able to capture the data in memory and examine it Give the Operating System a minimal amount of memory, forcing it to use a swap file Create a Separate partition of several hundred megabytes and place the swap file there Use intrusion forensic techniques to study memory resident infections

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)

Module 14 : Malware Forensics

Questions available : 29 You are not logged in.
Please Login for track your learning progress

Q. No: 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 |

Go to Question No.

Question No 24

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

Bookmark this Question

QID: 682

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

A: Use VMware to be able to capture the data in memory and examine it

B: Give the Operating System a minimal amount of memory, forcing it to use a swap file

C: Create a Separate partition of several hundred megabytes and place the swap file there

D: Use intrusion forensic techniques to study memory resident infections

WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Join Online Exam

Certification Examinations