Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A incident response analyst is performing evidence collection on a live enterprise server following an intrusion alert. According to the Order of Volatility standard, in what sequence should the analyst acquire the evidence sources, ordered from most volatile to least volatile?

  1. 1CPU registers and L1/L2 cache memory
  2. 2System RAM and active ARP routing tables
  3. 3Local solid-state persistent disk storage
  4. 4Off-site archival backup tapes

Answer

The correct sequence from most volatile to least volatile is: CPU registers and L1/L2 cache memory, followed by System RAM and active ARP routing tables, then Local solid-state persistent disk storage, and lastly Off-site archival backup tapes.
Forensic evidence acquisition follows RFC 3227 Order of Volatility: CPU registers and cache (most volatile) -> System RAM and network cache -> Local persistent disk storage -> Off-site archival backup tapes (least volatile).

Step-by-Step Solution

1
Assess the volatility of processor-level data structures.
CPU registers and caches change at nanosecond speeds and clear immediately upon CPU halt.
Processor memory represents the highest volatility tier in digital forensics.
2
Assess the volatility of main memory and active state information.
System RAM and ARP/routing caches hold volatile dynamic runtime data.
This data remains intact only while power is continuously supplied to the host.
3
Assess the volatility of local secondary storage media.
Local SSD and magnetic drives hold non-volatile data files.
Disk contents persist on physical media even after host power is removed.
4
Assess the volatility of offline long-term archives.
Archival backup tapes contain static snapshot data.
Offline backup media changes least frequently and retains data indefinitely.

Key Concept

Order of Volatility (RFC 3227)
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic