Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA Security+ · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Key word, volatile
In digital forensics, RAM (Random Access Memory) is considered the most volatile data source because: It holds live data such as running processes, network connections, encryption keys, and login credentials. Its contents are lost when the device powers off or reboots. It can contain critical evidence that never touches the hard drive or SSD. That’s why forensic investigators prioritize capturing RAM first—before any shutdown or disruption occurs.
When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.