nerdexam
GIAC

GCFA · Question #224

Which of the following data is NOT listed as a volatile data in RFC 3227 list for Windows based system?

The correct answer is C. Data on a hard disk. RFC 3227 defines volatile data as information lost when a system loses power or is altered by running processes; data on a hard disk is persistent and therefore not volatile.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following data is NOT listed as a volatile data in RFC 3227 list for Windows based system?

Options

  • AKernel statistics
  • BTemporary file system
  • CData on a hard disk
  • DRouting table

How the community answered

(61 responses)
  • A
    5% (3)
  • B
    8% (5)
  • C
    72% (44)
  • D
    15% (9)

Why each option

RFC 3227 defines volatile data as information lost when a system loses power or is altered by running processes; data on a hard disk is persistent and therefore not volatile.

AKernel statistics

Kernel statistics reside in RAM and reflect the live state of the operating system, making them volatile and subject to loss on shutdown or reboot.

BTemporary file system

Temporary file system data is transient by nature, stored in memory-mapped or RAM-backed locations, and qualifies as volatile data that must be collected before powering down.

CData on a hard diskCorrect

Data stored on a hard disk is non-volatile - it persists after power loss and is not subject to the rapid change or loss that characterizes volatile data, so RFC 3227 does not list it in the volatile data collection order and it is instead acquired through traditional disk imaging.

DRouting table

The routing table is maintained in kernel memory and changes dynamically with network events, classifying it as volatile data that RFC 3227 explicitly includes in the order of collection.

Concept tested: RFC 3227 volatile vs non-volatile data classification

Source: https://www.rfc-editor.org/rfc/rfc3227

Topics

#RFC 3227#volatile data#order of volatility#evidence collection

Community Discussion

No community discussion yet for this question.

Full GCFA Practice