When conducing digital forensics, order of volatility is an important consideration during the collection of data after an incident. With order of volatility in mind, which type of memory should evidence be collected from first?
Correct Incorrect Unanswered Report Issue Answer Description
The order of volatility states that cache memory is the most volatile and should be collected first. Being volatile means that when power is removed from the system the contents of that memory will be lost.
Wikipedia
In computing, a cache ( KASH) is a hardware or software component that stores data so that future requests for that data can be served faster; the data stored in a cache might be the result of an earlier computation or a copy of data stored elsewhere. A cache hit occurs when the requested data can be found in a cache, while a cache miss occurs when it cannot. Cache hits are served by reading data from the cache, which is faster than recomputing a result or reading from a slower data store; thus, the more requests that can be served from the cache, the faster the system performs.To be cost-effective and to enable efficient use of data, caches must be relatively small. Nevertheless, caches have proven themselves in many areas of computing, because typical computer applications access data with a high degree of locality of reference. Such access patterns exhibit temporal locality, where data is requested that has been recently requested already, and spatial locality, where data is requested that is stored physically close to data that has already been requested.
Cache_(computing) - Wikipedia, the free encyclopedia Subscribe to avoid duplicate questions and track your progress over time