Which artifacts are typically recovered from volatile memory during an incident?

• A. Archived logs on disk
• B. Running processes, network connections, loaded modules, registry keys, handles, and cryptographic keys in memory
• C. User profiles
• D. BIOS settings

Answer: (B)

Volatile memory captures the system’s live state at the moment of an incident, so investigators focus on what is actively loaded and in use. In RAM you can find running processes and the exact programs currently executing, which shows what the system is doing at that moment. Active network connections are also in memory, revealing open sockets and the remote endpoints the machine is communicating with. Loaded modules or DLLs that are resident in a process’s address space appear in RAM, showing the code and libraries in use during the incident. The in-memory state also includes handles to resources like files or registry keys that applications are currently using, as well as cryptographic keys or credentials that have been loaded into memory for ongoing operations. These RAM-resident artifacts give a live snapshot of attacker activity, malware behavior, and the tools being used.

Archived logs on disk, user profiles stored on disk, and BIOS settings reside in non-volatile storage and are not part of the live memory snapshot, so they are not typically recovered as volatile-memory artifacts.