What is the correct statement about volatile (RAM) versus non-volatile (disk) artifacts in a forensic investigation?

• A. RAM artifacts are preserved after power-off
• B. Disk artifacts are erased after reboot
• C. RAM can be accessed after power-off
• D. RAM captures current state and is lost on power-off

Answer: (D)

Volatile memory like RAM holds data only while power is supplied. It stores the system’s current state—running programs, open files, and memory-resident data—and because it’s volatile, all of that content is lost when power is removed. That’s why investigators perform live memory acquisition to capture RAM before shutting the system down; once power is off, RAM contents disappear and cannot be relied upon as evidence.

Non-volatile storage, such as a disk, behaves differently: it retains data after reboot and power cycles, providing persistent artifacts that remain across restarts (though they can be modified or erased by user actions). So the statement that RAM captures the current state and is lost on power-off is the accurate description of volatile memory in a forensic context. The other ideas conflict with the fundamental properties of RAM (that it’s lost after power-off) or with how disk data behaves (it isn’t erased simply by reboot).