What is the difference between volatile and non-volatile data in incident response?

• A. Volatile data resides in memory and is lost on shutdown; non-volatile data resides on disk and persists; memory must be captured first
• B. Volatile data persists after reboot; non-volatile data disappears
• C. Both are stored in the cloud only
• D. Non-volatile data is never altered

Answer: (C)

Volatile data refers to information that only exists in the system’s temporary memory (RAM) and is lost when power is removed or the system reboots. This includes the current state of running processes, open network connections, loaded modules, running services, and other memory-resident artifacts. Because it can disappear in an instant, responders capture memory first using memory dumps or live-response tools to preserve it before turning off or rebooting the machine.

Non-volatile data sits on persistent storage such as disks or solid-state drives and remains intact across reboots. This category covers files, logs, registry hives, configuration data, installed software, and other artifacts stored on disk. Analyzing non-volatile data provides a longer-term view of what happened and is typically done after imaging the disk or collecting file-based evidence.

The principle you’re after is that memory is ephemeral and must be acquired first, while disk/drive contents persist and can be analyzed later. Cloud or VM contexts still follow the same idea: RAM is volatile, disk volumes are non-volatile.