Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).

Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).
A . Page files
B . Event logs
C . RAM
D . Cache
E . Stored files
F . HDD

View Answer

Answer: C, D

Explanation:

In a forensic investigation, volatile data should be collected first, based on the order of volatility. RAM and Cache are examples of volatile data.

Reference: CompTIA Security+ Study Guide 601, Chapter 11