In what situations would collect an image of memory most useful to the investigation?

0

1.1kviews

In what situations would collect an image of memory most useful to the investigation?

written 6.2 years ago by

nisha.vanjari • 40

modified 2.2 years ago by

pedsangini276 • 4.7k

Subject: Digital Forensics

Topic: Initial response and forensic duplication

Difficulty: Low

digital forensics

ADD COMMENT EDIT

1 Answer

0

18views

written 6.2 years ago by

nisha.vanjari • 40

A memory image is useful in two situations.

First, when malware is primarily memory-resident and leaves little trace evidence on storage.

Second, when attackers use encryption. We’ve gained access to many a password-protected RAR file through the examination of memory images.

ADD COMMENT EDIT

Please log in to add an answer.