Which of the following types of media are most volatile and should be preserved?

A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence.

Which of the following types of media are most volatile and should be preserved? (Select two).
A . Memory cache
B. Registry file
C. SSD storage
D. Temporary filesystems
E. Packet decoding
F. Swap volume

View Answer

Answer: A,F

Explanation:

Memory cache and swap volume are types of media that are most volatile and should be preserved during a digital forensics investigation. Volatile media are those that store data temporarily and lose their contents when the power is turned off or interrupted. Memory cache is a small and fast memory that stores frequently used data or instructions for faster access by the processor. Swap volume is a part of the hard disk that is used as an extension of the memory when the memory is full or low.

Reference: https://www.techopedia.com/definition/10339/memory-dump