What is the primary value of volatile data in incident response?

• A. It resides in RAM and can reveal live in-memory activity not saved on disk.
• B. Volatile data is stored on hard drives for long-term analysis.
• C. Volatile data includes backups.
• D. Volatile data is only found in cloud storage.

Answer: (A)

Volatile data is the system’s live state stored in RAM, which disappears if power is lost. Its primary value in incident response is that it captures in-memory activity that never gets written to disk, such as running processes, open network connections, loaded modules, and memory-resident malware or encryption keys. This allows responders to see what the machine was actually doing at the moment of the incident, including indicators that could be hidden from disk-based artifacts (like fileless threats). Because volatile data is ephemeral, it must be collected during live response before the system is rebooted or shut down; once gone, that evidence is rarely recoverable. The other options describe data stored on hard drives, backups, or external/cloud storage, which are non-volatile and don’t provide the immediate snapshot of the system’s current activity.