Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).

Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).
A . Page files
B. Event logs
C. RAM
D. Cache
E. Stored files
F. HDD

View Answer

Answer: C, D

Explanation:

In a forensic investigation, volatile data should be collected first, based on the order of volatility. RAM and Cache are examples of volatile data.

Reference: CompTIA Security+ Study Guide 601, Chapter 11