Computer Hacking Forensic Investigator (CHFI v10) — Question 596

According to RFC 3227, which of the following is considered as the most volatile item on a typical system?

Answer options

• A. Archival media
• B. Temporary system files
• C. Kernel statistics and memory
• D. Registers and cache

Correct answer: D

Explanation

Registers and cache are considered the most volatile because they are the fastest storage locations and hold data that changes frequently during processing. In contrast, archival media is designed for long-term storage, while temporary system files and kernel statistics are less volatile compared to registers and cache.