Exam 312-49v10 topic 1 question 628 discussion

ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 04 Page 351-352 "The order of volatility for a typical computing system as per the RFC 3227 Guidelines for Evidence Collection and Archiving is as follows: 1. Registers, processor cache 2. Routing table, process table, kernel statistics, and memory 3. Temporary file systems 4. Disk or other storage media 5. Remote logging and monitoring data related to the target system 6. Physical configuration and network topology 7. Archival media" ----- If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

C < https://www.computer-forensics-recruiter.com/order-of-volatility/#:~:text=The%20IETF%20and%20the%20Order%20of%20Volatility&text=This%20document%20explains%20that%20the,%2C%20Process%20Table%2C%20Kernel%20Statistics%2C

C. Registers and cache, routing tables, temporary file systems, disk storage, archival media The order of volatility, from most volatile to least volatile, typically follows the pattern of data retention and volatility: Registers and cache: The most volatile as they contain data actively used by the CPU and are quickly overwritten. Routing tables: Can change based on network activity but are still relatively volatile. Temporary file systems: Contain temporary and transient data, often used by running processes. Disk storage: Holds persistent data on the storage media and is less volatile. Archival media: Refers to long-term storage media such as backups, which are the least volatile since they're intended for preservation.