Discuss GIAC GCED Exam Topic 9 Question 81

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

AEvent logs from a central repository

BDirectory listing of system files

CMedia in the CDrom drive

DSwap space and page files

Suggested Answer: D

Best practices suggest that live response should follow the order of volatility, which means that you want to collect data which is changing the most rapidly. The order of volatility is:

Memory

Swap or page file

Network status and current / recent network connections

Running processes

Open files

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Han 2 days ago

D) Swap space and page files can reveal hidden processes. Important but not first.

Donette 7 days ago

C) Media in the CDrom drive seems less urgent. Focus on active data first.

Corazon 12 days ago

I agree, but A) Event logs might be more useful for tracking actions.

Bette 17 days ago

I think B) Directory listing of system files should be first. It's crucial for understanding the current state.

Hortencia 22 days ago

True, but the directory listing shows current state, which is vital.

Kati 27 days ago

But we can't overlook the event logs; they tell the story of the system.

Hannah 1 month ago

Exactly, volatile data can give immediate insights into the incident.

Mila 1 month ago

Right, we need to focus on what's changing in real-time.

Hortencia 1 month ago

C) Media in the CDrom drive? Not a priority in a live incident.

Kati 2 months ago

A) Event logs are important too, but they can be collected later.

Hannah 2 months ago

I agree, but D) Swap space and page files might hold more volatile data.

Mila 2 months ago

I think B) Directory listing of system files should be first. It's crucial.

Alesia 2 months ago

Not sure about D, what if the swap space is empty?

Adell 2 months ago

Wait, why not A? Aren't event logs super useful?

Natalya 2 months ago

A seems important too, but D should be first.

Raymon 3 months ago

Totally agree, D is the right choice.

Thora 3 months ago

I'd go with D, swap space is crucial!

Pa 3 months ago

I wonder if the media in the CDrom drive is relevant at all; it seems like it would be less critical than the other options.

Alex 3 months ago

I practiced a similar question, and I feel like the directory listing might be important, but I can't recall if it's the first thing to collect.

Loren 3 months ago

I'm not entirely sure, but I remember something about event logs being crucial for understanding what happened during an incident.

Galen 3 months ago

I think we should prioritize collecting the swap space and page files first since they might contain volatile data.

GIAC GCED Exam - Topic 9 Question 81 Discussion