CompTIA Security+ (SY0-701) — Question 231

While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?

Answer options

• A. Hard drive
• B. RAM
• C. SSD
• D. Temporary files

Correct answer: B

Explanation

RAM is the most volatile form of storage, meaning its contents can be lost quickly when power is removed. In contrast, hard drives, SSDs, and temporary files are more stable and can retain data longer, making them less critical to collect first in a forensics investigation.