Digital Forensics with Kali Linux

Data volatility

In this section, we take a look at why data is lost when power to the volatile memory is lost.

Data can exist as long as the media it is stored on is capable of storing the data. Hard drives (mechanical and solid-state), flash drives, and memory cards are all non-volatile storage media. Although SSDs have and continue to make drastic improvements in data access times, RAM thus far remains the faster type of memory, typically referred to only as memory, inside devices.

RAM, however, is volatile memory. Unlike non-volatile memory found in hard drives and flash drives, data stored in RAM is kept there temporarily, only for as long as there is an electrical current being provided to the chips. There are two types of RAM that we ...