Discussion
In RAM forensics, which memory region is most likely to contain remnants of decrypted full-disk encryption keys ?
Answer: C
Decrypted full-disk encryption keys are most likely in the non-paged pool.
Full-disk encryption on Windows, such as BitLocker, is done by a kernel-mode driver that decrypts every sector as it is read. The driver keeps its key material in kernel memory allocated from the non-paged pool, which is never written out to the page file and is always resident in RAM. Memory forensics tools therefore recover such keys by scanning kernel pool allocations in a RAM image.
The smss.exe stack belongs to the Session Manager, a user-mode process that starts sessions and has no part in disk encryption. User-mode process heaps hold application data, not the keys of a kernel driver. Since one of the listed regions does fit, 'None of the above' is wrong.
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development