Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A digital forensics examiner is performing evidence collection on a powered-on enterprise server following a suspected breach. To ensure maximum preservation of transient evidence, the examiner must adhere strictly to the forensic Order of Volatility. Sequence the following evidence sources from most volatile (highest priority for acquisition) to least volatile (lowest priority for acquisition).

  1. 1Processor cache and CPU registers
  2. 2Physical system RAM and running process tables
  3. 3Swap files and pagefile space on local disk storage
  4. 4Offline archival backup tapes

Answer

The correct acquisition sequence from most volatile to least volatile is: Processor cache and CPU registers, followed by Physical system RAM and running process tables, followed by Swap files and pagefile space on local disk storage, and ending with Offline archival backup tapes.
Standard digital forensics practices (RFC 3227) require collecting evidence in order of volatility to prevent losing perishable data. CPU registers and cache change at instruction-level speeds and are most volatile. Physical RAM loses contents upon reboot or power-off. Swap and pagefiles reside on disk but hold temporary, frequently modified memory blocks. Offline archival tapes are static physical media stored offsite, making them the least volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifetime that changes during hardware execution.
Processor cache and CPU registers are placed first.
Registers and CPU caches alter state with every clock cycle and cannot be preserved once execution progresses or power changes.
2
Identify volatile system memory retained only while power is maintained.
Physical system RAM and running process tables are placed second.
System memory holds dynamic network connections, process structures, and unencrypted keys that disappear if the machine powers down.
3
Identify temporary disk-backed virtual memory structures.
Swap files and pagefile space on local disk storage are placed third.
Pagefiles reside on non-volatile physical disks, but their data blocks are temporary and actively overwritten by operating system memory management.
4
Identify long-term static offline storage media.
Offline archival backup tapes are placed last.
Archival media is offline, unpowered, and structurally static, making it the most durable and least volatile evidence source.

Key Concept

Order of Volatility in Digital Forensics
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic