Cisco CyberOps Associate (CBROPS) 200-201Host-Based AnalysisMedium
A security analyst is performing host-based analysis on a Windows system suspected of being compromised by a new, unknown malware variant. The analyst wants to capture a full memory dump of the system for later offline analysis. Which of the following considerations is most critical when performing memory acquisition on a live system to ensure forensic soundness?
- AUsing a tool that supports writing the memory dump directly to a removable USB drive.
- BVerifying the integrity of the acquired memory dump using a cryptographic hash after completion.
- CPrioritizing the use of a volatile memory acquisition tool that minimizes impact on the system's memory.
- DEnsuring the memory acquisition tool is run from a network share to avoid local disk writes.
Show answer & explanationAnswer & explanation
Correct answer: B. Verifying the integrity of the acquired memory dump using a cryptographic hash after completion.
Verifying the integrity of the acquired memory dump using a cryptographic hash (like MD5 or SHA256) is paramount for forensic soundness. This ensures that the collected evidence has not been tampered with or corrupted during acquisition or transfer, maintaining its admissibility and reliability in an investigation.
Why the other options are wrong
- A. Writing to a removable USB drive is a common practice to avoid altering the compromised system, but the integrity of the dump itself is still the most critical final step.
- C. Minimizing impact is important for a live system, but ensuring the *integrity* of the evidence once collected is the core of forensic soundness.
- D. Running from a network share is good to avoid local disk writes, but not as critical as integrity verification for forensic soundness.
Memory Acquisition Forensic Soundness
Ensuring that memory acquisition is performed in a way that preserves the integrity and authenticity of the collected digital evidence, making it reliable for forensic investigation.
- Minimize changes to the live system.
- Document every step.
- Verify integrity of acquired data.
Memory trick: Evidence integrity is key for legal certainty.