Home / server / Questions / 1003625
In Process
ron
Asked: 2020-02-19 13:57:47 +0800 CST

make a copy of everything in memory [security+]

  • 772

Comptia security+ exam question

An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following should a security analyst do FIRST?

A. Make a copy of everything in memory on the workstation.

B. Turn off the workstation.

C. Consult information security policy.

D. Run a virus scan.

The answer is A, make a copy of everything in memory.

How does one do that?

Once that is done, how is something like that useful?

For example if there's 16GB of DDR4 RAM installed, RAM is 75% used, gonna have 11GB, in the form of what?

security memory

1 Answers

  1. how is something like that useful?

    Assuming you have the right tools installed and symbols installed you can possibly search the memory for things. If you have the debug symbols installed on a test machine you can possibly debug code and see what is going on.

    If you don't have training for kernel level development it probably isn't that useful, and you are mostly just capturing this information to provide to an expert in case you need it.

    It can possibly used to confirm or rule out that the compromised system has recently sent or received data. It could possibly give you hints about the attackers control systems and so on. It could possibly tell you what information has been compromised, and which accounts on your network were currnetly being used.

    How does one do that?

    Well on Windows there are a couple sysinternals tools that can generate a dumpfile for the system or applications. The tricky part is that Crash dumps are mostly disabled on modern version of Windows by default and you have to restart to enable them. Restarting would clear the memory you want to capture. Even more complicated by the fact that you would probably want to isolate a compromised system first which means you might not have those tools available on the system you are examining.

    There are some tools listed on the Forensics Wiki (which appears to be offline when I checked) that might be useful for dumping memory. I haven't used any of the 3rd party tools.

    On the Linux side of things there may be a way to dump it depending on if you have the devices disabled or not. See this question over on superuser.

    • 0