Which artifacts are typically recovered from RAM during live system forensics?

• A. Running processes, network connections, loaded drivers, cryptographic keys in memory
• B. Archived emails on disk
• C. System logs on disk
• D. Backups on tape

Answer: (A)

In live system forensics, the focus is on volatile data that vanishes when the system powers down. RAM holds the current state of the machine, so you typically capture what is actively in use: the running processes and the memory they occupy, the network connections the host has open, and the modules or drivers loaded into memory at that moment. It’s also common to find cryptographic material—like session keys or private keys—that applications load into memory to perform their operations, since those secrets are often kept in RAM for speed rather than stored in plaintext on disk. This combination of in-memory processes, connections, and keys provides a real-time snapshot of activity and potential compromise. Data such as archived emails, system logs, or backups live on persistent storage and aren’t normally recovered from RAM, except for transient caches or pointers, which don’t represent the primary artifacts of interest.