Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

An incident response team is performing live digital evidence acquisition on a compromised enterprise application server following a detected in-memory code injection attack. To ensure dynamic evidence is captured before it is lost or modified, the forensic investigator must collect data strictly according to the standard Order of Volatility. Place the following digital evidence sources in the correct order of acquisition, from MOST volatile (acquired first) to LEAST volatile (acquired last).

  1. 1CPU registers and processor cache memory contents
  2. 2System RAM, active kernel process tables, and live ARP routing caches
  3. 3Temporary file system directories and virtual memory page/swap files
  4. 4Local persistent solid-state drive (SSD) system partitions
  5. 5Off-site optical backup media and long-term archival tape storage

Answer

The correct acquisition sequence from most volatile to least volatile is: CPU registers and processor cache memory contents -> System RAM, active kernel process tables, and live ARP routing caches -> Temporary file system directories and virtual memory page/swap files -> Local persistent solid-state drive (SSD) system partitions -> Off-site optical backup media and long-term archival tape storage.
The standard Order of Volatility established by RFC 3227 and CompTIA Security+ requires capturing evidence in sequence from shortest lifespan to longest lifespan: 1) CPU registers and cache, 2) Main memory (RAM) and network caches, 3) Temporary file systems and virtual memory/swap space, 4) Non-volatile local disk partitions, and 5) Remote/offline archival backups.

Step-by-Step Solution

1
Identify the primary principle of live evidence acquisition.
Digital evidence must be acquired starting with data that disappears fastest (highest volatility) to preserve transient indicators of compromise.
The Order of Volatility (RFC 3227) dictates that dynamic hardware memory components take precedence over persistent block storage.
2
Evaluate hardware memory volatility.
CPU registers and cache update continuously at CPU clock speeds, followed by system RAM and live kernel network caches.
CPU states are lost instantaneously upon context switching or power loss, while RAM retains dynamic operational data only while powered.
3
Evaluate disk-backed temporary storage vs. persistent block storage.
Swap files and temp directories are prioritized before physical OS disk partitions.
Swap/page files act as extended volatile memory on disk and are rapidly overwritten during continuous system operation compared to static file structures on primary drive partitions.
4
Order long-term and offline storage media.
Local persistent SSD partitions precede offline optical media and backup tapes.
Offline backup media and archival tapes are disconnected, static, and immutable, giving them the lowest volatility of all evidence types.

Key Concept

Order of Volatility (RFC 3227)
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic