During a forensic investigation on a Windows system, an analyst discovers that the attacker ran commands that left no files on disk. Which forensic technique can recover evidence of these commands?
Select an answer to reveal the explanation.
Short Explanation
When an attacker runs commands without dropping files, you need to look in RAM. Volatility memory forensics can recover the process list, command-line arguments, command history, and loaded modules even when nothing was written to disk.
Full Explanation
Memory forensics using Volatility is correct because fileless attacks execute entirely in memory; Volatility can recover process command-line arguments, injected shellcode, PowerShell command history, and loaded modules from a RAM dump even when nothing was written to disk. File system timeline analysis using the MFT is wrong because MFT analysis reveals file activity, and fileless attacks specifically leave no files to record in the MFT. Browser history analysis using forensic tools is wrong because browser history is irrelevant to fileless malware execution analysis. Examining the Windows Error Reporting cabinet files is wrong because Windows Error Reporting records application crash data, not arbitrary command execution.