An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS.
Which of the following technical approaches would be the MOST feasible way to accomplish this capture?
A. Run the memdump utility with the -k flag.
B. Use a loadable kernel module capture utility, such as LiME.
C. Run dd on/dev/mem.
D. Employ a stand-alone utility, such as FTK Imager
The correct answer is option (d)
D. Employ a stand-alone utility, such as FTK Imager
REASON:
A will dump all of the Kernel memory, but no physical memory
FTK is also used by the professionals in court.
C will dump all the physical memory, but no kernel memory
An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes....