How do you validate that a memory capture is forensically sound and not tampered with before analysis?

• A. Verify the memory dump hash, confirm the capture method used by a trusted tool, and document the chain-of-custody of the memory image
• B. Run a virus scan on the memory image and treat any result as proof
• C. Compare memory to a baseline from a different system
• D. Reboot and re-capture to see if contents match

Answer: (A)

Ensuring a memory capture is forensically sound hinges on three pillars: data integrity, trusted capture methods, and clear chain-of-custody. First, verifying the memory dump hash immediately after capture establishes that the exact bytes collected haven’t been altered since the moment of acquisition. By computing a cryptographic hash (for example, SHA-256) and securely storing that value with the image, you can later confirm the image remains unchanged during handling and analysis.

Second, using a capture method known to be trusted by the forensic community helps ensure the tool itself doesn’t modify memory or introduce artifacts. This means selecting a reputable memory acquisition tool and following best practices that minimize disturbance to the system, such as documenting tool version, exact options used, and avoiding unnecessary writes to the source. The goal is reproducibility and verifiability of the capture process.

Third, documenting chain-of-custody is essential. Every transfer, storage location, access control, and handling event should be recorded so the evidence can be traced from collection to analysis. This includes who performed the capture, when, where the image is stored, and how access is restricted, providing a verifiable history that supports admissibility and integrity.

Why the other ideas don’t fit: a virus scan on the memory image doesn’t prove the image’s integrity or authenticity and could be unreliable; comparing memory to a baseline from another system isn’t a valid validity check due to hardware and configuration differences; rebooting and recapturing changes volatile data and can’t prove that a prior capture was tampered with, since the memory contents aren’t preserved between reboots.