Exam 312-49v10 topic 1 question 740 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 740
Topic #: 1

In a situation where an investigator needs to acquire volatile data from a live Linux system, the physical access to the suspect machine is either restricted or unavailable. Which of the following steps will be the most suitable approach to perform this task?

A. The investigator should use the Belkasoft Live RAM Capturer on the forensic workstation, then remotely execute the tool on the suspect machine to acquire the RAM image
B. The investigator should initiate a listening session on the forensic workstation using 'netcat', then execute a 'dd' command on the suspect machine and pipe the output using 'netcat'
C. The investigator should leverage OSXPMem to remotely parse the physical memory in the Linux machine and create AFF4 format images for analysis
D. The investigator should employ the LiME tool and 'netcat', starting a listening session using tcp:port on the suspect machine and then establishing a connection from the forensic workstation using 'netcat'

Show Suggested Answer

Suggested Answer: D 🗳️

by Elb at May 28, 2024, 11:39 p.m.

Comments

Submit Cancel

Elb

6 months ago

Selected Answer: D

To acquire RAM remotely over a network, the investigator must start a listening session on a suspect machine using tcp:port Command: insmod lime-<kernel_module>.ko “path=tcp:<port> format=lime” On the forensics workstation, the investigator should establish connection with the suspect machine using netcat and dump RAM data over the network Command: nc <IP Address of the Suspect Machine>:<port> > filename.mem

upvoted 1 times

...

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam

Exam 312-49v10 topic 1 question 740 discussion

Comments

Elb

Get IT Certification

New Version GCP Professional Cloud Architect Certificate & Helpful Information

The 5 Most In-Demand Project Management Certifications of 2019