CompTIA Security+ (SY0-501) — Question 734

During a forensic investigation, which of the following must be addressed FIRST according to the order of volatility?

Answer options

• A. Hard drive
• B. RAM
• C. Network attached storage
• D. USB flash drive

Correct answer: B

Explanation

The correct answer is RAM because it is the most volatile form of data storage, meaning its contents can be lost quickly when power is removed. In contrast, hard drives, network attached storage, and USB flash drives retain data for longer periods, making them less urgent to preserve during an investigation.