hard20 pts · first answer countsincident-responsememory-forensicsforensics

Proving a memory capture is sound

Unlike a disk, RAM changes every second, so a second capture will never match the first. How do you best support the integrity of a live memory capture?

A.Capture memory twice and only keep it if both hashes matchB.Hash the dump right after capture and record the tool, time and steps usedC.Skip memory capture, because it can never be used as evidenceD.Print the memory dump on paper so it cannot be changed

Discussion 0

Join free to post in the discussion.

Proving a memory capture is sound

Discussion 0

Related questions