312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ243

Tools/Systems/Programs

Henry, a forensic investigator, is analyzing a system suspected of compromise by a stealthy rootkit. The rootkit appears sophisticated and is concealing its files and processes to evade detection. Henry decides to perform memory and registry analysis to reveal the hidden rootkit. Which of the following tools is the best choice for Henry’s task?

  • A RegRipper
  • B Volatility
  • C Dumplt
  • D Autopsy
Explanation

Volatility is a memory-forensics framework that analyzes memory images for rootkit indicators, including concealed processes and kernel-level artifacts. It can also extract and analyze registry information resident in memory, making it well suited to investigating a stealthy rootkit.

Community Discussion

No comments yet. Be the first to start the discussion!