Volatile Memory is one of the leading problems for forensics.

Vendor: ECCouncil
Product: 412-79
Update on: Jul 25, 2025
Questions: 232

ECCouncil 412-79 Question Answer

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Use Vmware to be able to capture the data in memory and examine it

Give the Operating System a minimal amount of memory, forcing it to use a swap file

Create a Separate partition of several hundred megabytes and place the swap file there

Use intrusion forensic techniques to study memory resident infections