220-1102 Question 738
Single answerOrder of volatilityA technician is responding to a suspected malware infection on a user's Windows workstation. The system is still powered on, and the security team wants to preserve as much forensic evidence as possible before shutting it down for imaging. Which action should the technician take FIRST based on the order of volatility?
- A
Capture the contents of system memory (RAM)
- B
Create a forensic image of the hard drive
- C
Collect archived log files from the SIEM
- D
Document the workstation's asset tag and physical location
Show answer and explanation
Correct answer: A
Explanation
The order of volatility means investigators should collect the most ephemeral data first because it is most likely to change or disappear. On a live compromised workstation, RAM is generally captured before less-volatile data such as disk contents, remote logs, or administrative documentation. This principle is consistent with digital forensics and incident response best practices commonly taught for CompTIA A+ Core 2, including preserving live system state before powering down a device. After capturing volatile data such as memory and active network/process information, the technician can proceed with less volatile evidence collection, such as disk imaging, log review, and physical documentation.
- A. Correct.
Correct. In the order of volatility, data in RAM is among the most volatile and can be lost immediately if the system is powered off or rebooted. Live memory can contain running processes, network connections, encryption keys, injected code, and other evidence that may not be recoverable from disk later. Preserving RAM first aligns with standard incident response and forensic best practices.
- B. Incorrect.
Incorrect. A forensic image of the hard drive is important, but disk data is less volatile than memory. If the technician images the drive first and the system crashes, reboots, or is shut down, critical live data in RAM will be lost. This option reflects a common mistake of prioritizing persistent storage before ephemeral evidence.
- C. Incorrect.
Incorrect. SIEM log data may be useful for the broader investigation, but those archived logs are not more volatile than the evidence currently residing in the affected workstation's memory. Because the question asks what to do first on the still-running system, this is not the highest-priority evidence to capture.
- D. Incorrect.
Incorrect. Documenting physical details is part of good chain-of-custody and incident documentation, but it does not take priority over collecting highly volatile evidence from a live system. Those details can usually still be recorded after the most time-sensitive data has been preserved.