What is a stealthy method for memory acquisition?

• A. RAM freeze trick
• B. RAM dump software
• C. Live process enumeration
• D. Disk imaging

Answer: (A)

Capturing volatile data without tipping off the system centers on preserving the memory state with minimal change to running processes and logs. The RAM freeze trick embodies that by stabilizing the contents of RAM—essentially slowing down changes and making a quick, discreet dump possible with little OS activity. This approach aims to minimize artifacts and detection, which is why it’s considered stealthy: you can obtain the memory snapshot while keeping the system’s normal behavior largely intact.

In contrast, using RAM dump software usually leaves traces of activity, processes running in memory, and logs that can be detected by security tools. Live process enumeration focuses on listing what’s running rather than extracting memory contents, so it doesn’t yield a memory snapshot. Disk imaging targets non-volatile storage, not volatile memory, so it misses the volatile data you’d want in memory.