312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ253

Procedures and Methodology

William, a forensic specialist, was tasked with investigating a system breach by extracting Tor Browser–related artifacts from a memory dump acquired from the victim’s machine.

During the investigation, William analyzed the memory dump and found that it contained the maximum possible number of Tor Browser artifacts. To fully understand the scope of the evidence, he needed to determine which condition would cause the maximum number of artifacts to be present in the memory dump. Which of the following conditions gave William the maximum possible number of artifacts?

  • A Tor browser closed
  • B Tor browser opened
  • C Tor browser installed
  • D Tor browser uninstalled
Explanation

Volatile memory contains the greatest number of Tor Browser artifacts while Tor Browser is running, because its active processes and in-memory browser, session, configuration, and network data are resident in RAM. An installed, closed, or uninstalled browser does not retain the same volume of active memory-resident evidence. Tor Browser is launched as a running application before it can connect to the Tor network and perform browsing activity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!