CHFI Incident Response and First Responder Skills Practice Question

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

⚠ Common exam trap

EC-Council often tests the order of volatility (OOV) principle, and the trap here is that candidates mistakenly prioritize persistent data (logs, registry, disk image) over volatile memory, thinking they are more stable or easier to collect first.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Acquire a memory dump using a tool like WinPmem.

When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Acquire a memory dump using a tool like WinPmem.
Why this is correct
RAM is the most volatile component in a Windows system and must be captured before any other action, because it holds currently running processes, active network sockets, loaded kernel modules, injected code, and plaintext encryption keys. Using WinPmem (or similar tools) creates a raw memory image that can be analyzed for malware artifacts that exist only in volatile memory, such as reflective DLLs or rootkits. Any subsequent step in the incident response workflow will alter memory contents, so the order of volatility dictates that memory acquisition comes first.
✗
Collect the Windows Event Logs.
Why it's wrong here
Windows Event Logs are stored as .evtx files on disk and contain records of logons, process creation, service installs, and other security-related activities, making them valuable for timeline reconstruction. However, they are non-volatile and persist across reboots, so they can be collected later without losing evidence. Moreover, merely opening or querying the live Event Log can generate new events and potentially modify metadata, so you should defer log collection until after a RAM image has been securely captured.
✗
Export the contents of the Windows Registry.
Why it's wrong here
Exporting the Registry captures persistent configuration data but does not capture volatile artefacts such as running processes, network connections, or memory-resident malware. In a live incident, the correct first step is to acquire RAM, which holds the current execution state. This option is tempting because Registry hives often contain persistence mechanisms like Run keys, making it a valid choice after memory acquisition.
✗
Create a forensic image of the hard drive.
Why it's wrong here
Creating a forensic image of the hard drive preserves persistent artifacts such as executables, registry hives, browser history, and deleted files, but it does not capture live system state. Volatile data like running processes, established TCP connections, memory-resident malware, and encryption keys exist only in RAM and vanish once the system is powered down or overwritten by further activity. Since disk data is non-volatile and can be imaged later with a write-blocker, the incident responder must prioritize the memory dump over disk imaging in a live malware investigation.

Go deeper

CHFI Incident Response and First Responder Skills Practice Question

Why each option matters

Option-by-option breakdown

Related to this question