Your manager hands you several items of digital evidence and asks you to investigate them in the order of volatility. Which of the following is the MOST volatile?

The correct answer is A. Cache. In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access…

Computer Forensics in Incident Handling

Question

Options

ACache
BDisk
CEmails
DTemp files

How the community answered

(45 responses)

A
87% (39)
B
7% (3)
C
4% (2)
D
2% (1)

Explanation

In the context of digital evidence investigation, volatility refers to how quickly data can change or be lost when power is removed or systems are altered. Among the options provided, cache is the most volatile because it is temporary storage that is designed to speed up access to data and is frequently overwritten. Cache data resides in RAM and includes things like memory buffers, system and network information, and process execution data, which are lost upon reboot or power loss. This contrasts with disks, emails, and temp files, which are considered less volatile because they are stored on permanent or semi-permanent media and are less likely to be immediately lost or overwritten.

Topics

#order of volatility#digital evidence#cache memory#evidence collection

Community Discussion

No community discussion yet for this question.

Full 212-89 Practice