Exam 312-49v10 topic 1 question 706 discussion

B and C Both options are for remote acquisition.. Step 4.2.1: Acquire Volatile Data from a Linux Machine Using dd and Netcat (Remote Acquisition) Step 4.2.2: Acquire Volatile Data from a Linux Machine Using LiME and Netcat (Remote Acquisition)

"To acquire RAM remotely over a network, the investigator must start a listening session on a forensic workstation using netcat. Command: nc -l <port> > filename.dd ▪ On the suspect machine, the investigator should use dd command and pipe the output using Netcat. Command: dd if=/dev/fmem bs=1024 | nc <IP Address of the Suspect Machine> <port> " Page 338

To acquire RAM remotely over a network, the investigator must start a listening session on a suspect machine using tcp:port Command: insmod lime-<kernel_module>.ko “path=tcp:<port> format=lime” On the forensics workstation, the investigator should establish connection with the suspect machine using netcat and dump RAM data over the network Command: nc <IP Address of the Suspect Machine>:<port> > filename.mem

I meant to answer B

D < | https://github.com/504ensicsLabs/LiME https://ioflood.com/blog/nc-linux-command/