Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A digital forensics responder is preparing to collect evidence from a powered-on target workstation. Place the following memory and storage components in the correct sequence according to the standard Order of Volatility, starting from the MOST volatile to the LEAST volatile.

  1. 1CPU registers and cache memory
  2. 2System RAM (Random Access Memory)
  3. 3Local solid-state drive (SSD) storage
  4. 4Archival backup tape media

Answer

The correct order from most volatile to least volatile is: CPU registers and cache memory, followed by System RAM (Random Access Memory), then Local solid-state drive (SSD) storage, and finally Archival backup tape media.
According to standard digital forensics guidelines (such as RFC 3227), evidence collection must proceed from the most transient/volatile data to the least volatile data. CPU cache and registers change constantly and are lost first, followed by system RAM. Local disk storage retains data permanently across reboots, while offline archival tapes are static and non-volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifespan
CPU registers and cache memory are identified as the most volatile because contents change continuously during CPU cycles.
Data in registers and processor cache is extremely transient and easily overwritten or cleared.
2
Identify volatile system runtime memory
System RAM is placed second.
RAM contains live system memory (running processes, network sockets, unencrypted secrets) which disappears when the host loses power.
3
Identify non-volatile local storage
Local SSD storage is placed third.
Disk storage persists data across power cycles and system reboots, making it significantly less volatile than RAM or CPU cache.
4
Identify long-term offline storage
Archival backup tape media is placed last.
Archival backups are offline, highly resilient, and change least frequently among all listed sources.

Key Concept

Order of Volatility in Digital Forensics
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic