Which technique involves shutting down the infected system and booting from an alternative trusted media to find traces of the rootkit?

Which technique involves shutting down the infected system and booting from an alternative trusted media to find traces of the rootkit?

• A. Cross View-Based Detection
• B. Alternative Trusted Medium
• C. GMER
• D. Anti-Rootkits

Answer: (B)

Booting from an alternative trusted medium is about performing an offline inspection to defeat rootkit hiding. When a system is infected, a rootkit can conceal itself while the operating system is running by hooking into memory and core services. By shutting down and starting up from a clean, trusted USB or CD/DVD, you load a separate environment that isn’t infected and can access the hard drive without the rootkit’s hooks active. This lets you scan for traces the rootkit leaves behind—like hidden files, altered boot records, or unsigned/kernel modules—that wouldn’t be visible or accessible from the compromised OS. That’s why this technique is described as using an Alternative Trusted Medium: you rely on booting from media you trust rather than the suspect system. Other options describe on-system detection or tools, which don’t capture this offline, boot-from-trusted-media approach.

Booting from an alternative trusted medium is about performing an offline inspection to defeat rootkit hiding. When a system is infected, a rootkit can conceal itself while the operating system is running by hooking into memory and core services. By shutting down and starting up from a clean, trusted USB or CD/DVD, you load a separate environment that isn’t infected and can access the hard drive without the rootkit’s hooks active. This lets you scan for traces the rootkit leaves behind—like hidden files, altered boot records, or unsigned/kernel modules—that wouldn’t be visible or accessible from the compromised OS. That’s why this technique is described as using an Alternative Trusted Medium: you rely on booting from media you trust rather than the suspect system. Other options describe on-system detection or tools, which don’t capture this offline, boot-from-trusted-media approach.