Question

Carl is beginning a digital forensic investigation. he has been sent into the field to collect a machine. when he arrives, he sees that the computer is running windows and has open applications. he decides to preserve as much data as possible by capturing data in memory. what should carl perform

Answer 1

Answer:

Volatile memory analysis

Explanation:

volatile data analysis in a computer's memory dump memory forensics is used by information security specialists to examine and identify assaults or harmful actions that leave no clearly identifiable trails on hard disk data which os what Carl decides to preserve as much data as possible by capturing data in memory