CHFI Computer Forensics Fundamentals and Process Practice Question
A first responder arrives at a crime scene involving a suspected hacking incident. The suspect's computer is powered on and logged in. The responder needs to decide the first action to preserve evidence. According to the order of volatility, which of the following should be collected first?
⚠ Common exam trap
The trap here is assuming that persistent storage like the hard drive should be collected first because it contains the most data, ignoring that RAM is far more volatile and easily lost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The contents of RAM
The order of volatility dictates that the most perishable evidence be collected first. RAM loses its contents when power is removed, making it the highest priority. Hard drives, event logs, and temporary files are stored on persistent media and can be acquired later. First responders should capture RAM before any other action to preserve critical volatile data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hard drive contents
Why it's wrong here
The hard drive is less volatile than RAM; it retains data even when powered off. While it is a primary source of evidence, it should be imaged after volatile data is captured. Imaging the hard drive first would take time and potentially allow volatile evidence to be lost. Therefore, the hard drive is not the first priority according to the order of volatility.
- ✓
The contents of RAM
Why this is correct
RAM is the most volatile evidence and is lost immediately upon power loss. It can contain running processes, open network connections, encryption keys, and unsaved data that may be crucial to the investigation. According to the order of volatility, RAM should be captured before any other action. First responders should use a memory capture tool to preserve this data without altering the system significantly.
- ✗
The system's event logs
Why it's wrong here
Event logs are stored on the hard drive and are not as volatile as RAM. They can provide valuable information about system activity, but they persist after shutdown. Capturing them before RAM would be a mistake because RAM contains more perishable data. Event logs should be collected as part of the disk image or separately after volatile data is secured.
- ✗
The temporary files in the user's profile
Why it's wrong here
Temporary files reside on the hard drive and are not volatile in the same sense as RAM. They may be overwritten over time, but they are not lost immediately upon power loss. The order of volatility prioritizes RAM first. Collecting temporary files before RAM would risk losing critical memory-resident evidence. Therefore, this is not the first action.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
Process Memory Dump
A process memory dump is a snapshot of all the data a specific running program has stored in RAM at a single moment, used for analyzing its behavior and contents.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.