(a) Explian two limitations of dead-box analysis.
(b) Describe why memory analysis is difficult.
(c) With reference to the "Shadow Walker" rootkit, explain what is meant by memory cloaking. What is the goal of memory cloaking?
(d) Explain the Locard's Exchange Principle.
(e) Name four useful data that may be collected during live acquisition.