An Incident Responder Wants to Capture Volatile Memory Comprehensively from a Running

question 352

Multiple Choice

An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS. Which of the following technical approaches would be the MOST feasible way to accomplish this capture?

• A) Run the memdump utility with the -k flag. Run the memdump utility with the -k flag.
• B) Use a loadable kernel module capture utility, such as LiME.
• C) Run dd on/dev/mem. Run dd on/dev/mem.
• D) Employ a stand-alone utility, such as FTK Imager.

---

Definitions:

Geological Time Period

A system of chronological dating that relates geological strata to time, used by geologists to describe the timing and relationships between events that have occurred during Earth's history.

Hominoids

A term that refers to the group of primates that includes all great apes and humans, characterized by a larger brain and more complex behaviors compared to other primates.

Oligocene

A geologic epoch of the Paleogene Period, occurring about 33.9 to 23 million years ago, noted for major changes in mammalian evolution.

Eocene

The Eocene is a geological epoch that lasted from about 56 to 33.9 million years ago, during which warm climates prevailed and early mammals diversified following the extinction of the dinosaurs.