Which type of data is most commonly analyzed in memory forensics to identify credential access?

• A. Browser history
• B. Network router configurations
• C. Live processes, network connections, loaded modules, and credentials
• D. Scheduled tasks

Answer: (C)

Memory forensics focuses on volatile data stored in RAM to capture the system’s live state. The most informative data for identifying credential access are the items that reflect what is actively running and how the system is handling credentials at runtime: live processes show exactly what programs are operating; network connections reveal where the system is communicating, which can include traffic to command-and-control or credential-exfiltration endpoints; loaded modules disclose the code and libraries currently in use by those processes, which can indicate code injection, credential dumping tools, or rootkits; and credentials or credential-related artifacts present in memory expose tokens, password hashes, or other sensitive material that attackers may use or exfiltrate. Analyzing this combination provides direct visibility into credential access techniques as they occur in memory, something that static artifacts like browser history, router configurations, or scheduled tasks do not reveal in the same way.