Non-Volatile Data
Definition
Data that persists without power, such as files on a hard disk, SSD, or optical media, and data in non-volatile memory chips. Non-volatile data can be collected after shutdown, though best practice is to collect it after volatile data in a live-response scenario.
- Persistence
- Remains without power
- Examples
- Hard disk and SSD files, optical media, non-volatile memory chips
- Collection order
- After volatile data in a live-response scenario
- Reference framework
- Order of volatility guidance (e.g. RFC 3227)
Common questions
Why is non-volatile data collected after volatile data rather than first?+
Volatile data such as RAM contents and network state is lost the moment a system loses power or the process ends, while non-volatile data on disk survives a shutdown, so responders prioritise capturing the fragile evidence before it disappears.
Can non-volatile evidence still be lost or altered during collection?+
Yes, improper handling such as booting the original drive, letting antivirus or the OS write to it, or using a non-write-blocked interface can alter timestamps and file content, which is why forensic imaging tools and write blockers are standard practice.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Live Response
- The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would...
- Memory-Resident Malware
- Malicious code that executes entirely in RAM and writes no files to disk. Fileless malware, PowerShell-based loaders, and certain rootkits fall into...
- RFC 3227
- Guidelines for Evidence Collection and Archiving, published by the IETF in February 2002. It defines the order of volatility, the documentation requirements...
- Volatile Data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...