Exam 312-49v10 topic 1 question 633 discussion

D > 7.3. Demonstrate Memory Forensics Using Volatility & PhotoRec

D. Volatility In the scenario described, Jeff could use the tool "Volatility" to acquire a memory dump of the Windows 10 computer. Volatility is an open-source framework specifically designed for memory forensics. It allows investigators to analyze and extract information from memory dumps, which can be critical in investigating cyber attacks, such as the DDoS attack mentioned. Options A, B, and C are not directly related to memory forensics: Memcheck is a component of the Valgrind tool for detecting memory-related errors in C and C++ programs. RAMMapper is not a recognized tool in the context of memory forensics. Autopsy is a digital forensics platform primarily used for analyzing disk images, not memory dumps.

Per page 583 (V10) you cannot use Volatility to dump the RAM, but you need to use another RAM dump tool and later use Volatility to analyse the contents. So I would say; no right answer here.