Exam 312-49v10 topic 1 question 90 discussion

VMware is a virtualization software that can be used to create a virtual machine on a physical host system. By creating a virtual machine, the forensic analyst can install an operating system and software that is identical to the system being investigated. When the system is running, VMware can capture a snapshot of the virtual machine's memory, which can be analyzed later. This method ensures that the volatile memory is captured before it disappears when the system is shut down. It also provides a safe and isolated environment to analyze the data. Options B and C are not recommended as they involve manipulating the system's memory management, which could alter or destroy critical data. The use of swap files can also overwrite important data. Option D may be useful in some situations, but it is not specifically designed for capturing volatile memory. Intrusion forensic techniques focus on identifying and analyzing the steps taken by an attacker to gain access to a system, rather than capturing volatile memory.

it is C