Which statement correctly contrasts primary memory with secondary memory in forensics?

• A. Primary memory is non-volatile storage; secondary memory is volatile
• B. RAM artifacts are only about screens; disk artifacts
• C. Primary memory is volatile and fast; secondary memory is non-volatile storage
• D. Secondary memory is volatile; RAM stores long-term data

Answer: (C)

Understanding how memory types differ in volatility and persistence is fundamental in forensics. Primary memory (RAM) is volatile and very fast; it holds data that active programs and the operating system are using, but its contents are lost when power is removed. Secondary memory (disk storage) is non-volatile, meaning data persists after the system is powered off and is used for long-term storage of files, system logs, and other persistent data. This difference is why the best description is that primary memory is volatile and fast, while secondary memory is non-volatile storage. The other ideas mix up these characteristics: memory isn’t limited to screen-related artifacts and RAM can contain many transient artifacts beyond what’s visible on a screen; and secondary storage does not lose data when power is removed, unlike RAM.