Which of these describes volatile evidence?

The correct answer is B. registers and cache. Registers and cache are examples of volatile evidence. These store temporary data used by the CPU and system processes for quick access. They are volatile in nature as their content is not retained when the system loses power or undergoes a restart. This makes them highly…

Submitted by daniela_cl· Mar 6, 2026Host-Based Analysis

Question

Options

Alogs
Bregisters and cache
Cdisk and removable drives
Dusernames

How the community answered

(12 responses)

B
92% (11)
D
8% (1)

Explanation

Registers and cache are examples of volatile evidence. These store temporary data used by the CPU and system processes for quick access. They are volatile in nature as their content is not retained when the system loses power or undergoes a restart. This makes them highly volatile and prone to rapid change or loss, especially during system shutdowns or reboots. Other examples of volatile evidence include system memory (RAM) and network connections, which are also temporary and easily altered or lost when the system is powered off.

Topics

#Digital forensics#Volatile data#Memory forensics

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice