CHFI Computer Forensics Investigation Process Practice Question
A CHFI analyst is called to investigate a suspected insider threat. The suspect's laptop is turned on and logged in. The analyst needs to capture volatile data before shutting it down. Which of the following should the analyst capture first?
⚠ Common exam trap
The trap here is assuming that hard drive data is more important because it is larger, ignoring that RAM is irreplaceable once lost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The contents of the RAM
RAM is the most volatile data and is lost when the system is powered off. Capturing it first preserves running processes, network connections, and potentially encryption keys. Hard drive contents, event logs, and browser cache are non-volatile and can be acquired later. Following the order of volatility is a key principle in forensic investigations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The contents of the RAM
Why this is correct
RAM contains volatile data such as running processes, network connections, and encryption keys, which are lost when the system is powered off. Capturing RAM first preserves this critical evidence. It is the most volatile and should be prioritized. Tools like FTK Imager or Volatility can be used for memory capture.
- ✗
The contents of the hard drive
Why it's wrong here
The hard drive is non-volatile and retains data even when powered off. It can be imaged later without loss. Capturing it first would delay securing volatile data like RAM, which is time-sensitive. The order of volatility dictates that RAM should be captured before the hard drive.
- ✗
The web browser cache
Why it's wrong here
Browser cache is stored on the hard drive and is non-volatile. It may contain useful artifacts, but it is not as time-sensitive as RAM. Capturing it first would ignore the order of volatility. RAM should be captured before any disk-based data.
- ✗
The system event logs
Why it's wrong here
Event logs are stored on the hard drive and are non-volatile. While important, they are not as volatile as RAM. They can be collected after memory capture. Prioritizing logs over RAM could result in loss of critical volatile evidence.
Go deeper
Related to this question
Learn chapter
Database Forensics: Investigating Data Breaches
Key term
Process Memory Dump
A process memory dump is a snapshot of all the data a specific running program has stored in RAM at a single moment, used for analyzing its behavior and contents.
Key term
RAM Analysis
RAM Analysis is the forensic examination of a computer’s volatile memory to uncover evidence of running processes, network connections, malware, and user activity that is lost when the system is powered off.
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.