Memory forensics basics in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is memory forensics?

Memory forensics is the process of analyzing a computer's memory (RAM) to find evidence of malicious activity or understand system behavior.

beginner

Why is RAM important in memory forensics?

RAM holds data about running programs and system state, including malware that may not be saved on disk, making it crucial for detecting live threats.

beginner

Name a common tool used for memory acquisition.

Volatility and FTK Imager are popular tools used to capture the contents of RAM for analysis.

intermediate

What kind of information can memory forensics reveal?

It can reveal running processes, network connections, loaded drivers, passwords in memory, and evidence of malware or hacking activity.

beginner

What is a memory dump?

A memory dump is a snapshot of the contents of RAM at a specific time, saved to a file for later forensic analysis.

What does memory forensics primarily analyze?

A Network traffic

B Contents of RAM

C Hard drive files

D Email logs

Memory forensics focuses on analyzing the contents of RAM to find evidence.

Which tool is commonly used to capture memory for analysis?

A Nmap

B Wireshark

C Volatility

D Metasploit

Volatility is a popular tool for memory acquisition and analysis.

Why might malware be found in RAM but not on disk?

A Malware runs only in memory and does not save files

B Malware deletes itself from disk immediately

C Disk is always encrypted

D RAM is slower than disk

Some malware operates only in memory to avoid detection on disk.

What is a memory dump?

A A backup of hard drive

B A list of installed software

C A log of network activity

D A snapshot of RAM contents

A memory dump captures the contents of RAM at a moment in time.

Which of these can memory forensics help identify?

A Running processes

B Deleted emails

C Physical hardware faults

D Printer settings

Memory forensics can reveal running processes and system state.

Explain what memory forensics is and why it is useful in cybersecurity investigations.

Think about what data lives in RAM and how it helps find live threats.

Describe the process and purpose of creating a memory dump.

Consider how capturing RAM contents helps forensic experts.