Digital › Module 2 › Lesson 1
Volatile vs Persistent
Volatile evidence lives in RAM and live state; persistent evidence survives reboot — name both on YOUR $DFIR_LAB order-of-volatility map.
Visual · t26_volatile_vs_persistent
Volatile/persistent literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Power off too early and RAM artifacts vanish — literacy starts with what disappears first.
Volatile evidence includes RAM contents, active network connections, running processes, and some live registry/cache state — lost or altered on shutdown. Persistent evidence includes disk sectors, firmware logs (sometimes), cloud sync files on disk, and archived logs — survives reboot if not overwritten. Cyberlium maps volatile vs persistent on YOUR $DFIR_LAB scenario cards — not live imaging of stranger machines without authority. Next: Disk/Memory/Net/Logs.
1. Volatile evidence (named)
RAM: processes, encryption keys in memory, malware injected only in RAM, clipboard (OS-dependent). Live network: established connections, routing table, ARP cache. Live system: logged-on users, open handles — capture before power-off when policy allows.
On $DFIR_LAB, list three volatile classes for a practice VM scenario — no live stranger host required.
Command guide
Try these commands — Volatile evidence (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence types — https://www.sans.org/cyber-security-skills/digital-forensics/ (volatile vs non-volatile literacy) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (order of volatility) CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
python3 - <<'PY'
order = ['Registers/cache', 'RAM', 'Network state', 'Running processes', 'Disk', 'Backups/logs']
print('Order of volatility (RFC 3227 literacy):')
for i, item in enumerate(order, 1): print(f' {i}. {item}')
print('Lab: document types — never dump stranger production RAM')
PYCommand — copy this
curl -sS https://www.rfc-editor.org/rfc/rfc3227 | head -8
Primary tools to practice this lesson: curl, python3. Reference sites: Evidence types (https://www.sans.org/cyber-security-skills/digital-forensics/); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Persistent evidence (named)
Disk: files, unallocated space, slack, registry hives on disk, browser databases, event logs stored on volume. Backups and cloud-sync folders on disk are persistent once written — still need authority to collect.
Defenders image disks and pull logs after volatile collection when incident policy permits — order matters.
3. Order-of-volatility literacy
Classic teaching order: network/live capture → memory → disk → logs/archives — adapted to org policy and safety. Forbidden: rebooting a lab victim VM before noting what volatile data you would lose.
Ship: two-column table — volatile vs persistent with one $DFIR_LAB example each. Next: Disk/Memory/Net/Logs.
4. What you ship: volatile vs persistent table for $DFIR_LAB
Two-column table with examples from YOUR practice scenario. $DFIR_LAB named. NO stranger live imaging. chmod 600.
5. What you record before the next lesson
Date. Volatile/persistent table. $DFIR_LAB named. File t26-m02-l01-volatile-vs-persistent.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Reboot practice VM before documenting volatile loss. Image stranger laptop live without authority.
Right
Write volatile vs persistent table for YOUR $DFIR_LAB scenario. Next: Disk/Memory/Net/Logs.
Mission: map volatility on YOUR lab scenario
1) List three volatile classes. 2) List three persistent classes. 3) Note order-of-volatility one-liner. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Memory before disk is a mantra — policy still rules live collection.
Knowledge Check
APPLY: Volatile evidence includes:
Multiple choice
Knowledge Check
APPLY: True or False: Persistent evidence generally survives reboot.
True or False
Knowledge Check
APPLY: Order-of-volatility literacy helps by:
Multiple choice