Chapter 13: Incident-Handling Activities

1. (2)
   Network connections are volatile because the attacker's device is likely to be removed from the network on detection. Volatile data is characterized by data that can be changed or removed by factors outside of the investigator's control (for example, time or actions by other entities).
   The operating system time is volatile because it can be synchronized using NTP. If there was a discrepancy between system time and the NTP time, this discrepancy would be invisible to the investigator once it was re-synchronized.
   Paging files are not cleared when the process is ended; they simply go to unallocated. They are cleared when a new process requires that paging file and writes data to it.
   Network configuration can also be volatile. This is particularly true if DHCP is used.
   The CSIRT needs to send some of the failed hard drives to...