Which of the following types of digital evidence is temporarily stored in a digital device that requires constant power supply and is deleted if the power supply is interrupted?

The correct answer is B. Process memory. Process memory (RAM) is a type of digital evidence that is temporarily stored and requires a constant power supply to retain information. If the power supply is interrupted, the information stored in process memory is lost. This type of evidence can include data about running…

Computer Forensics in Incident Handling

Question

Options

ASlack space
BProcess memory
CEvent logs
DSwap file

How the community answered

(66 responses)

A
6% (4)
B
89% (59)
C
2% (1)
D
3% (2)

Explanation

Process memory (RAM) is a type of digital evidence that is temporarily stored and requires a constant power supply to retain information. If the power supply is interrupted, the information stored in process memory is lost. This type of evidence can include data about running programs, user actions, system events, and more, making it crucial for forensic analysis, especially in identifying actions taken by both users and malware. Collecting data from process memory helps incident responders understand the state of the system at the time of an incident and can reveal valuable information that is not persisted elsewhere on the device.

Topics

#volatile evidence#process memory#RAM forensics#digital evidence types

Community Discussion

No community discussion yet for this question.

Full 212-89 Practice