Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A cybersecurity analyst is responding to an active incident on a powered-on workstation. The analyst must capture digital evidence while strictly adhering to the order of volatility. Which of the following evidence sources should the analyst capture FIRST?

  1. System RAM (Random Access Memory)Answer
  2. B
    Local hard disk drive image
  3. C
    Network shared drive logs
  4. D
    Archival magnetic tape backups

Answer

System RAM (Random Access Memory) must be captured first because it is the most volatile evidence source among the given choices.
System RAM contains transient data that is permanently lost if the machine is powered off or restarted. Forensic standards require capturing volatile memory before non-volatile media to preserve active processes, network connections, and unencrypted data.

Step-by-Step Solution

1
Review the forensic order of volatility principle.
Evidence must be collected starting from the most volatile (easily altered or lost) to the least volatile (persistent long-term storage).
Collecting evidence in order of volatility prevents critical transient data—such as open network sockets or memory-resident malware—from being lost.
2
Compare the volatility of system RAM against secondary storage, network logs, and backups.
RAM loses all contained data as soon as power is turned off or the machine reboots, whereas hard drives, network shares, and tapes preserve data persistently.
Primary system memory is volatile RAM, whereas disk drives and tapes are non-volatile media.
3
Determine the highest priority source.
System RAM is the most volatile component among the listed options and must be acquired first.
Direct alignment with standard digital forensics best practices.

Key Concept

Order of Volatility in Digital Forensics
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic