Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

An auditor investigating a suspected intrusion into the servers of a Chennai firm must capture data that disappears when power is lost, such as running processes and network connections. According to the order of volatility, how should the auditor proceed?

The auditor should capture volatile data such as memory contents, running processes and network connections first. The order of volatility requires collecting the most perishable evidence before more persistent sources like disks and backups, because powering off would permanently destroy it.

  1. ASwitch off the server at once and image the hard disk later
  2. BCollect volatile data such as memory contents first, before less volatile disk dataCorrect
  3. CCollect archived backup tapes first because they are most reliable
  4. DCollect printed logs first, since paper records are most volatile

Explanation

The order of volatility says the most easily lost data should be captured first. RAM, running processes and network connections vanish on power-off, while disk data and backups persist longer. Powering off first, the wrong approach, would destroy the volatile evidence.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions