Data Collection Procedures

Question 1

After an attack, before you restore your servers into operational status, what must you do to preserve evidence?

Answer 1

Create a forensic disk image of the data for evidence

Question 2

What is the order of volatility?

Answer 2

1. CPU registers and cache memory
2. Routing tables, ARP cache, process table, kernel statistics, memory (RAM)
3. Temporary files
4. Disk (HDD/SDD/flash drive)
5. Remote logging and monitoring data
6. Physical configuration and network topology
7. Archival media

Exam Tip: You have to remember this in order