Volatile Evidence
Definition
Data that exists only while a system is running: active processes, logged-in sessions, network socket state, decryption keys in memory, and command history. Lost on shutdown or reboot.
Related terms
- Attacker-Alerting Risk
- The risk that a containment action signals to the attacker that they have been detected, potentially triggering destructive countermeasures on systems they...
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Computer Forensics
- Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline:...
- Digital Evidence
- Any information of probative value stored or transmitted in binary form. Latent, volatile in part, easily altered, and admissible only if integrity...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Network Isolation
- Disconnecting a compromised host from all network interfaces while leaving it powered on. Preserves volatile memory contents but removes the attacker's communication...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Short-Term Containment
- Immediate actions taken after incident confirmation to stop an attack from spreading, without waiting for full scope analysis. Distinguished from long-term containment,...
- Traffic Blocking
- Adding firewall rules, null routes, or DNS sinkholes to deny communication between attacker-controlled infrastructure and the victim network. Effective against external command-and-control...
- VLAN Segmentation
- Moving a compromised device or subnet into a separate VLAN with restrictive access control lists, limiting lateral movement to other network segments...
Explained in these topics
- Computer Forensics: Cyber Crimes, Digital Evidence, Seizure and AcquisitionData lost when power is removed: CPU registers and cache, RAM contents, routing table, ARP cache, process list, network connections. Captured live before shutd...
- Short-Term Containment TechniquesData that exists only while a system is running: active processes, logged-in sessions, network socket state, decryption keys in memory, and command history. Lo...