Memory Flashcards
1
Q
What is the order of volatility
A
CPU Registers
System Memory
Pagefile/swap
ARP Cache
Routing
MFT Entries
Registry
HD Image
BIOS/UEFI
2
Q
What are the benefits of FTK Imager?
A
Simpler
Smaller memory footprint
3
Q
What do “x”s mean in the output of WinPMem?
A
Memory read slowly.
4
Q
What is Memory Smear?
A
It is memory that is “smeared” because of reading memory slowly.
5
Q
TEB
A
Thread Environment Block
6
Q
What does a TEB point to?
A
A PEB.
7
Q
A
