Which of the following digital evidence temporarily stored on a digital device that requires a constant power supply and is deleted if the power supply is interrupted?

The correct answer is D. Process memory. Process memory, or volatile memory (RAM), is digital evidence that requires a constant power supply to retain data and is deleted or lost when the power supply is interrupted. It contains information about the system's ongoing processes and operations. This type of evidence can…

Computer Forensics in Incident Handling

Question

Options

ASwap file
BEvent logs
CSlack space
DProcess memory

How the community answered

(49 responses)

A
4% (2)
B
4% (2)
C
2% (1)
D
90% (44)

Explanation

Process memory, or volatile memory (RAM), is digital evidence that requires a constant power supply to retain data and is deleted or lost when the power supply is interrupted. It contains information about the system's ongoing processes and operations. This type of evidence can be crucial for forensic investigations as it may hold information about user actions, system events, and the state of applications and services at the time of an incident. Unlike swap files, event logs, and slack space, which can retain information without a constant power supply, process memory is inherently volatile and its contents are lost when a device is powered off or restarts.

Topics

#volatile evidence#digital evidence types#process memory#RAM forensics

Community Discussion

No community discussion yet for this question.

Full 212-89 Practice