Question1. Explain two limitations of the dead-box analysis.
Question2. Describe why memory analysis is difficult.
Question3. With reference to the “Shadow Walker” rootkit, describe what is meant by memory cloaking. What is the objective of memory cloaking?
Question4. Describe the Locard’s Exchange Principle. Support your answer with example.
Question5. Name four useful data that may be collected throughout live acquisition.
Question6. Forensic methodology comprises three basic phases. Briefly explain these three phases.
Question7. Sometimes it’s best not to perform hard-disk acquisition. Provide two circumstances where it’s best not to perform hard-disk acquisition.