Exam CS0-002 topic 1 question 259 discussion

Memory cache and temporary filesystems are considered the most volatile types of media because they contain information that can be easily overwritten or lost when the system is restarted or powered off. Memory cache, also known as RAM, is used to temporarily store data and commands that are frequently accessed by the computer's processor. This data is not permanently stored on the computer's hard drive, making it vulnerable to being lost or overwritten when the system is restarted. Temporary filesystems, also known as temp files, are used to store data that is temporarily needed for a specific process or task. These files are not meant to be permanent and are usually deleted when the task is completed. However, in some cases, these files may contain important information that is relevant to a digital forensics investigation. If not properly preserved, this data can be easily lost or overwritten, making it important for the digital forensics investigator to preserve these types of media.

key word is : types of MEDIA (memory cache and swap files) are a type of media. Temp files are not a MEDIA

terrible question

watched J Dion and i think i will go with A and D though swap files are highly volatile too but i will go with what i know.

Comptia....for an old Sec+ the answer for such a question had the option for Swap/Temp files...wonder if they actually have an engineer look over their questions or just bureaucrats...

AD sec+ question almost

Memory cache and Swap are considered volatile memory Temp files live in C:\Users\AppData\Local\Temp (not volatile)

Temporary filesystems are another type of volatile storage that are used to store temporary data and files. They are typically used by applications during runtime and may contain important data that can be lost when the system is shut down or restarted.

The main reference as seen from the book for order of volatility can be seen here: The ISOC best practice guide to evidence collection and archiving, published as tools.ietf.org/html/rfc3227

Based on the order of volatility, memory cache is first and then swap volume (i.e. paging file for windows), because both can be erased when rebooting. https://blogs.getcertifiedgetahead.com/cfr-and-order-of-volatility/

I am torn on this one, we know Memory Cache is a given. so we are left with Swap volume (swap space) or Temp files. I would lean to Temp files since most of what you would need besides that is Cache.

The swap file is considered to be a extension of RAM and is lost on reboot. It's thus higher on the volatility hierarchy than the temp files.

References: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response SANS Institute, Digital Forensics and Incident Response (DFIR) Fundamentals Course.

This is a tricky one - both the swap file and the temporary files are highly volatile - I don't know which would be be put above the other and I can't find any reference that specifies this.