While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
Choose an answer
Tap an option to check your answer.
Correct answer: RAM.
Why this is the answer
RAM (Random Access Memory) is the most volatile data source because its contents are lost almost immediately when power is removed or the system is shut down. In digital forensics, the principle of volatility dictates that data sources that are most likely to disappear quickly should be collected first to preserve evidence. Hard drives and SSDs store persistent data that remains even after power loss, making them less volatile than RAM. Temporary files, while sometimes critical, are stored on persistent storage (like a hard drive or SSD) and are not as immediately lost as data in RAM.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed