4.5 key aspects of digital forensics

Question 1

order of volatility

Answer 1

most volatile data to capture first:

CPU, Ram
Memory, tables, kernel
temporary file systems
disk
remote data
physical configurations
archival media

Question 2

swap/pagefile

Answer 2

a system file that creates temporary storage space on a hard disk or solid-state drive.

Question 3

snapshot

Answer 3

for virtual machines
point-in-time system image

Question 4

cache

Answer 4

store data for later use and is cached in CPU, disk, internet, etc.

Question 5

hashing integrity

Answer 5

digital fingerprint for cryptographic integrity thru hashing

Question 6

checksum integrity

Answer 6

simple integrity check
protects from accidental changes during transmission

Question 7

provenance integrity

Answer 7

documentation of origination
data handling