Exam 312-49v10 topic 1 question 706 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 706
Topic #: 1

A Computer Hacking Forensic Investigator is acquiring volatile data from a Linux-based suspect machine that they cannot physically access. They need to obtain a dump of the system's RAM remotely. Which of the following sequences of commands and tools should be utilized for a forensically sound extraction?

A. On the forensic workstation: insmod lime-.ko "path= format=lime"; on the suspect machine: nc : > filename.mem
B. On the suspect machine: insmod lime-.ko "path=tcp: format=lime": on the forensics workstation: nc : > filename.mem
C. On the forensic workstation: nc -l > filename.dd; on the suspect machine: dd if=/dev/fmem bs=l024 | nc
D. On the suspect machine: dd if=/dev/fmem of= bs=lMB; on the forensic workstation: nc -l > filename.dd

Show Suggested Answer

Suggested Answer: B 🗳️

by Elb at April 24, 2024, 1:11 p.m.

Comments

Submit Cancel

Elb

1 year ago

Selected Answer: B

B and C Both options are for remote acquisition.. Step 4.2.1: Acquire Volatile Data from a Linux Machine Using dd and Netcat (Remote Acquisition) Step 4.2.2: Acquire Volatile Data from a Linux Machine Using LiME and Netcat (Remote Acquisition)

upvoted 1 times

...

db902ec

1 year ago

Selected Answer: C

"To acquire RAM remotely over a network, the investigator must start a listening session on a forensic workstation using netcat. Command: nc -l <port> > filename.dd ▪ On the suspect machine, the investigator should use dd command and pipe the output using Netcat. Command: dd if=/dev/fmem bs=1024 | nc <IP Address of the Suspect Machine> <port> " Page 338

upvoted 1 times

...

Elb

1 year ago

Selected Answer: B

To acquire RAM remotely over a network, the investigator must start a listening session on a suspect machine using tcp:port Command: insmod lime-<kernel_module>.ko “path=tcp:<port> format=lime” On the forensics workstation, the investigator should establish connection with the suspect machine using netcat and dump RAM data over the network Command: nc <IP Address of the Suspect Machine>:<port> > filename.mem

upvoted 1 times

...

Elb

1 year, 1 month ago

Selected Answer: B

I meant to answer B

upvoted 1 times

...

Elb

1 year, 2 months ago

D < | https://github.com/504ensicsLabs/LiME https://ioflood.com/blog/nc-linux-command/

upvoted 1 times

...