Examkin

Question

Difficulty: Very hardDigital Forensics and Chain of Custody

An incident response team is conducting live digital forensics on a powered-up enterprise database server experiencing active kernel-level malware execution and network exfiltration. To prevent the loss of critical evidence during acquisition, in what exact sequence should the investigator collect the following digital evidence sources, starting with the MOST volatile source and ending with the LEAST volatile source?

  1. 1CPU registers, L1/L2/L3 cache memory, and processor execution pipelines
  2. 2System RAM, kernel process tables, active network sockets, and ARP cache
  3. 3Temporary file systems, operating system swap space, and virtual memory pagefiles
  4. 4Local non-volatile storage media, solid-state drives (SSDs), and NVMe block storage volumes
  5. 5Off-site archived backup tapes, cloud cold storage snapshots, and optical backup media

Answer

The correct sequence from most volatile to least volatile is: CPU registers and cache memory → System RAM and active network/kernel tables → Temporary file systems and swap space → Local non-volatile NVMe/SSD storage → Off-site archived backup media.
In digital forensics, evidence acquisition follows RFC 3227 Order of Volatility guidelines to ensure ephemeral data is captured before it evaporates or gets overwritten. CPU registers and L1/L2/L3 cache represent the most volatile tier because data shifts within nanoseconds. Physical RAM, active network sockets, ARP tables, and running process tables form the second tier because they rely on continuous system power. Pagefiles and swap space form the third tier; while located on disk, their contents change rapidly during OS memory swapping. Local persistent storage (SSDs/NVMe) is non-volatile and forms the fourth tier. Off-site archival media and cold backups are static long-term records, placing them in the final, least volatile tier.

Step-by-Step Solution

1
Apply the RFC 3227 Order of Volatility guidelines for digital evidence collection.
Standard hierarchy established: Registers/Cache > System RAM/Kernel Tables > Swap/Temp Files > Local Disk Storage > Remote/Archival Media.
Volatile evidence collection must prioritize storage components with the shortest lifespan to prevent automated memory decay or overwriting.
2
Identify CPU hardware state data as position 1.
Item 1 (CPU registers, L1/L2/L3 cache) is placed first.
Processor registers and cache levels change continuously with every clock instruction cycle, making them extremely transient.
3
Identify system volatile RAM and live kernel structures as position 2.
Item 2 (System RAM, ARP cache, kernel tables) is placed second.
Random access memory depends on constant electrical charge and active power, losing all context immediately upon shutdown or power failure.
4
Identify virtual memory paging and swap structures as position 3.
Item 3 (Swap space, pagefile.sys, temporary file systems) is placed third.
Paging files reside on physical disk sectors but undergo rapid dynamic updates during memory swapping operations.
5
Identify local persistent drive storage as position 4.
Item 4 (Local non-volatile storage, NVMe, SSD) is placed fourth.
Local solid-state or magnetic drives are non-volatile and maintain stored data without electrical power.
6
Identify off-site long-term backups as position 5.
Item 5 (Off-site archived backup tapes, cold cloud snapshots) is placed fifth.
Archival storage backups are static, stored offline or in write-once repositories, and present zero risk of immediate volatile alteration.

Key Concept

Order of Volatility (RFC 3227)
Estimated Time:2m 30s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic