FOR500 Questions with complete
solution
User Communication, File Download, Program Execution, File Open/Creation,
File Knowledge, Physical location, USB Key usage, Account usage, Browser
usage - correct answer "Evidence of" Categories
Image Ram, Check for encrytpion, create quick triage image, begin analysis of
triage image, image entire drive. - correct answer Triage Accquistion step by
step
processes, network connections, open files-registry keys-devices,
configuration parameters, encryption keys-passwords, memory only expoits-
rootkits. - correct answer Whats in memory/why do we capture it?
FTK Imager, Magnet forensics ramcapture, belkasoft live ram capture,
Dumpit, WinPMEM, Redline. - correct answer Memory capture tools for live
system
Hiberfile - correct answer Memory capture tools for dead system
solution
User Communication, File Download, Program Execution, File Open/Creation,
File Knowledge, Physical location, USB Key usage, Account usage, Browser
usage - correct answer "Evidence of" Categories
Image Ram, Check for encrytpion, create quick triage image, begin analysis of
triage image, image entire drive. - correct answer Triage Accquistion step by
step
processes, network connections, open files-registry keys-devices,
configuration parameters, encryption keys-passwords, memory only expoits-
rootkits. - correct answer Whats in memory/why do we capture it?
FTK Imager, Magnet forensics ramcapture, belkasoft live ram capture,
Dumpit, WinPMEM, Redline. - correct answer Memory capture tools for live
system
Hiberfile - correct answer Memory capture tools for dead system
