During a forensic investigation on a Windows system, an analyst discovers that the attacker ran commands that left no files on disk. Which forensic technique can recover evidence of these commands?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because fileless attacks execute entirely in memory; Volatility's memory forensics can recover process command-line arguments, injected shellcode, PowerShell command history, and loaded modules from a RAM dump even when nothing was written to disk. A is wrong because MFT analysis reveals file activity; fileless attacks specifically leave no files to record in the MFT.
Full explanation below image
Full Explanation
B is correct because fileless attacks execute entirely in memory; Volatility's memory forensics can recover process command-line arguments, injected shellcode, PowerShell command history, and loaded modules from a RAM dump even when nothing was written to disk. A is wrong because MFT analysis reveals file activity; fileless attacks specifically leave no files to record in the MFT. C is wrong because browser history is irrelevant to fileless malware execution analysis. D is wrong because Windows Error Reporting records application crash data, not arbitrary command execution.