PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 4 : Capture RAM first to recover encryption keys, then take a logical image while the volume is still unlocked

Advertisement

Detailed Solution

सही उत्तर Capture RAM first to recover encryption keys, then take a logical image while the volume is still unlocked है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

A suspect laptop with BitLocker encryption is seized while powered on and unlocked. Which acquisition sequence gives the examiner the best chance of reading the data? / BitLocker एन्क्रिप्शन वाला संदिग्ध लैपटॉप चालू और अनलॉक हालत में जब्त हुआ। कौन-सा अधिग्रहण क्रम डेटा पढ़ने का सबसे अच्छा मौका देता है?

1.
Pull the plug immediately, then take a bit-stream image of the powered-off disk
2.
Take only a logical file copy and skip memory capture to save time
3.
Shut down normally through the operating system, then image the disk
4.
Capture RAM first to recover encryption keys, then take a logical image while the volume is still unlocked

Correct Answer: Capture RAM first to recover encryption keys, then take a logical image while the volume is still unlocked

RAM holds the BitLocker keys while unlocked; a powered-off bit-stream image is just ciphertext without them, so volatile memory must be captured before any shutdown. / अनलॉक अवस्था में RAM में एन्क्रिप्शन कीज़ होती हैं; बिना उनके पावर्ड-ऑफ इमेज सिर्फ सिफरटेक्स्ट है। Option (a) is the trap — pulling the plug destroys the keys in RAM.

Downloaded from PrepSnap (prepsnap.in)