Question

An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS.
Which of the following technical approaches would be the MOST feasible way to accomplish this capture?
A. Run the memdump utility with the -k flag.
B. Use a loadable kernel module capture utility, such as LiME.
C. Run dd on/dev/mem.
D. Employ a stand-alone utility, such as FTK Imager

Answer 1

The correct answer is option (d)

D. Employ a stand-alone utility, such as FTK Imager

REASON:

A will dump all of the Kernel memory, but no physical memory

FTK is also used by the professionals in court.

C will dump all the physical memory, but no kernel memory