What is volatile information?
Volatile information is considered fragile evidence as it refers to information that is lost after a period of time or when the computer is turned off. Volatile information can reside in the computer’s random access memory (RAM), page cache files or in other areas of the computer. Analysis of this information can yield significant insight into the suspect computer. It is important that an incident response expert collects volatile information before it is lost forever.