nerdexam
CompTIA

CAS-002 · Question #848

An investigator wants to collect the most volatile data first in an incident to preserve the data that runs the highest risk of being lost. After memory, which of the following BEST represents the…

The correct answer is C. System processes, network processes, file system information, swap files and raw disk blocks. Digital forensics follows a defined order of volatility to collect the most transient evidence first before it is lost.

Enterprise Security

Question

An investigator wants to collect the most volatile data first in an incident to preserve the data that runs the highest risk of being lost. After memory, which of the following BEST represents the remaining order of volatility that the investigator should follow?

Options

  • AFile system information, swap files, network processes, system processes and raw disk blocks.
  • BRaw disk blocks, network processes, system processes, swap files and file system information.
  • CSystem processes, network processes, file system information, swap files and raw disk blocks.
  • DRaw disk blocks, swap files, network processes, system processes, and file system information.

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    4% (2)
  • C
    86% (42)
  • D
    8% (4)

Why each option

Digital forensics follows a defined order of volatility to collect the most transient evidence first before it is lost.

AFile system information, swap files, network processes, system processes and raw disk blocks.

This order incorrectly places file system information and swap files before network and system processes, which are far more volatile and will be lost when a process terminates or a connection drops.

BRaw disk blocks, network processes, system processes, swap files and file system information.

Raw disk blocks are the least volatile data in the list and should be collected last, not first after memory; this order is reversed from correct forensic practice.

CSystem processes, network processes, file system information, swap files and raw disk blocks.Correct

After memory, the correct order per RFC 3227 and standard forensic practice is: system processes (running in RAM and most ephemeral), network processes (active connections that terminate quickly), file system information (metadata like timestamps that can change), swap files (virtual memory paged to disk), and finally raw disk blocks (most persistent). This sequence ensures the most transient data is captured before it disappears.

DRaw disk blocks, swap files, network processes, system processes, and file system information.

Placing raw disk blocks before system and network processes is incorrect because active processes and network state are far more volatile and would be lost long before disk contents change.

Concept tested: Digital forensics order of volatility

Source: https://www.rfc-editor.org/rfc/rfc3227

Topics

#order of volatility#digital forensics#volatile storage#evidence preservation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice