Which of the following are typically considered volatile data in memory forensics?

• A. Active processes and open network connections
• B. Archived user documents on disk
• C. System restore points
• D. Log files on hard drive

Answer: (A)

Volatile data in memory forensics is information that only exists while the system is powered and running, residing in RAM. It captures the current state of the machine, which changes constantly as processes run and network activity occurs. Active processes embody this because the process list, memory allocations, and handles are kept in memory to manage execution. Open network connections are also in RAM, reflecting the live network stack with sockets, endpoints, ports, and statuses. This live-state information is transient and can disappear with a power cycle, so it must be collected from memory before shutdown.

In contrast, archived user documents on disk, system restore points, and log files on the hard drive live on persistent storage. They survive reboots and power interruptions, so they’re considered non-volatile data. They can be examined after the fact, but they don’t represent the system’s immediate, in-memory state.