Volatile Evidence
Definition
Data that exists only while a system is running: active processes, logged-in sessions, network socket state, decryption keys in memory, and command history. Lost on shutdown or reboot.
- Field
- Digital forensics, cyber incident response
- Definition
- Data existing only while the system is running
- Examples
- Active processes, logged-in sessions, socket state, memory decryption keys
- Loss trigger
- System shutdown or reboot
- Related term
- Volatile data, order of volatility
Common questions
How does volatile evidence differ from volatile data as forensic terms?+
In practice the two terms are used interchangeably for RAM-resident and session-state information, though 'volatile evidence' is sometimes used more broadly to include short-lived non-memory artifacts like an active login session or an in-progress network connection that a status query, not a memory dump, captures.
Why is command history considered volatile evidence in many investigations?+
Shell command history held only in an active session buffer, before it is flushed to a history file on disk, disappears on logout or reboot, so investigators capture it live through session inspection rather than relying on the saved history file alone, which an attacker may also have cleared.
What containment decision is complicated by the need to preserve volatile evidence?+
Isolating a compromised host by pulling its network cable or shutting it down, the fastest way to stop ongoing damage, destroys network socket state and any evidence held only in RAM, so responders must weigh containment speed against evidence preservation.
Related terms
- Attacker-Alerting Risk
- The risk that a containment action signals to the attacker that they have been detected, potentially triggering destructive countermeasures on systems they...
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Computer Forensics
- Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline:...
- Digital Evidence
- Any information of probative value stored or transmitted in binary form. Latent, volatile in part, easily altered, and admissible only if integrity...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Network Isolation
- Disconnecting a compromised host from all network interfaces while leaving it powered on. Preserves volatile memory contents but removes the attacker's communication...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Short-Term Containment
- Immediate actions taken after incident confirmation to stop an attack from spreading, without waiting for full scope analysis. Distinguished from long-term containment,...
- Traffic Blocking
- Adding firewall rules, null routes, or DNS sinkholes to deny communication between attacker-controlled infrastructure and the victim network. Effective against external command-and-control...
- VLAN Segmentation
- Moving a compromised device or subnet into a separate VLAN with restrictive access control lists, limiting lateral movement to other network segments...
Explained in these topics
- Computer Forensics: Cyber Crimes, Digital Evidence, Seizure and AcquisitionData lost when power is removed: CPU registers and cache, RAM contents, routing table, ARP cache, process list, network connections. Captured live before shutd...
- Short-Term Containment Techniques