Question

5. you must recover the contents of the arp cache as vital evidence of a manin- the-middle attack. should you shut down the pc and image the hard drive to preserve it?

Answer 1

No. If you power off the computer, the arp cache will be lost.

To recover the contents of the arp cache, you can simply run the arp utility and direct that output to a file. In this way, you are able to save the arp cache to a non-volatile medium, and it will be easily readable for your review in the investigation.

Alternatively, you could dump the system memory to an output file and then later search it for the arp cache; however, this method produces a lot more data that must be parsed, but could reveal other indicators of compromise. No