CHFI Computer Forensics Fundamentals and Process Practice Question

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

⚠ Common exam trap

The CHFI exam often tests the distinction between volatile and non-volatile evidence, and the trap here is that candidates mistakenly think system logs or registry hives are volatile because they are 'system' data, when in fact they are stored on the hard drive and persist after power-off.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Contents of RAM and network connections

When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
System logs stored in the Event Viewer
Why it's wrong here
Event Viewer logs are persisted as .evtx files in the Windows\System32\winevt\Logs directory, making them non-volatile evidence that survives a loss of power. Although they record security-relevant events like logon attempts, they are stored on disk and can be examined after shutdown. For this reason, they do not qualify as the most volatile evidence needing immediate capture.
✗
Files stored on the hard drive
Why it's wrong here
Files stored on the hard drive reside on non-volatile media, meaning their contents remain intact even after the system is powered off. This allows investigators to perform a dead-disk acquisition by removing the drive and creating a forensic image without losing any file system data. Since these files are always available for later analysis, they are not considered volatile evidence that must be collected first.
✗
Registry hives
Why it's wrong here
Registry hives such as SAM, SYSTEM, and SOFTWARE are memory-mapped, but their backing stores are regular files on the system volume, like C:\Windows\System32\config\SYSTEM. Even though some subkeys exist only in volatile memory (e.g., HKLM\HARDWARE), the hives themselves are written to disk and persist across reboots. Consequently, they are non-volatile and not the top priority for collection.
✓
Contents of RAM and network connections
Why this is correct
The contents of RAM and active network connections are the most volatile evidence on a live system. RAM loses all data the instant power is cut, wiping out running processes, open network sockets, and any decrypted data or encryption keys; likewise, the current TCP/UDP connection table, ARP cache, and routing state exist only while the operating system is operational. Consequently, these must be captured using live forensic toolkits before shutdown, as any delay or power loss destroys them irrecoverably.

Visual reference

Go deeper

CHFI Computer Forensics Fundamentals and Process Practice Question

Why each option matters

Option-by-option breakdown

Related to this question