Detective Sarah, a skilled digital forensics investigator, begins probing a compromised computer system linked to a cybercrime ring. Prioritizing volatile data, she meticulously plans her evidence…

Question

Options

• ADisk or other storage media containing potentially critical files
• BTemporary file systems where recent activity might be stored
• CArchival media such as a DVD-ROM or a CD-ROM
• DThe physical configuration and network topology of the system

• A
  13% (2)
• B
  7% (1)
• C
  7% (1)
• D
  73% (11)

Explanation

This question directly relates to CHFI v11 objectives under Data Acquisition and Duplication and the concept of order of volatility, which is formally defined in RFC 3227 (Guidelines for Evidence Collection and Archiving). CHFI v11 stresses that forensic investigators must collect the most volatile data first, as it is the most likely to be lost or altered during system shutdowns or continued operation. According to RFC 3227, the order of volatility starts with data that changes most rapidly, such as system state and network-related information. This includes the physical configuration of the system, network topology, routing tables, ARP cache, active network connections, and running processes. These elements can disappear immediately if the system is powered off or network connectivity changes, making them the highest priority during live response.

No community discussion yet for this question.