312-39V2: Certified SOC Analyst v2

A SOC analyst at a national cybersecurity agency observed unusual system behavior on critical-infrastructure servers. Initial scans indicated possible malware activity. Because the suspected attack was sophisticated and involved registry-key changes, process injection, and unauthorized tasks, the incident was escalated to the forensic team. The forensic team believes the malware is intended for stealthy data exfiltration. To fully evaluate the compromise, the team captured system snapshots before and after the suspected infection to identify unauthorized changes and anomalies. Which process is the forensic team using by capturing and comparing system snapshots to detect unauthorized changes and anomalies?