Volatility and Digital Evidence Collection

Why This Topic Matters

Almost every modern fraud leaves a digital footprint. Emails, spreadsheets, accounting system logs, chat messages, browser history, and mobile device data are frequently the most persuasive evidence in a fraud examination. But digital evidence is fragile in a way that paper evidence is not: it can be altered, overwritten, or destroyed in seconds, sometimes simply by turning a machine on or off. If a fraud examiner mishandles a device, the evidence may become inadmissible, the opposing side may successfully argue it was tampered with, or critical data may vanish forever.

The ACFE tests this area heavily in the Investigation section of the CFE Exam, under the broader heading of collecting evidence and digital forensics. The examiners want to know that you understand two things: (1) that some data disappears faster than other data, and (2) the correct sequence and precautions for seizing and preserving digital evidence so that its integrity and admissibility are protected. This guide covers both.

What Is Volatility?

Volatility refers to how quickly digital data is lost when a system loses power or when time passes. Data is described as being either volatile or non-volatile:

- Volatile data exists only while the device is powered on. When power is removed, it is gone. Examples include the contents of random access memory (RAM), CPU registers and cache, running processes, open network connections, logged-in users, the clipboard, unsaved documents, and decryption keys held in memory.
- Non-volatile data persists after the device is powered off. Examples include files on hard drives and solid-state drives, data on USB sticks, optical media, backup tapes, and cloud storage.

The practical consequence is simple but crucial: volatile data must be collected first, while the system is still running, or it will be lost.

The Order of Volatility

The widely accepted framework (originating in RFC 3227, Guidelines for Evidence Collection and Archiving) ranks data sources from most volatile to least volatile. Evidence should be collected in this order:

1. CPU registers and cache - changes in nanoseconds; practically impossible to capture reliably.
2. Routing tables, ARP cache, process tables, kernel statistics, and RAM (memory) - lost at power-off; can be captured with live forensic tools.
3. Temporary file systems and swap/page files - may be cleared at shutdown or reboot.
4. Hard disk and other fixed storage - persistent, but can be altered by normal system operation.
5. Remote logging and monitoring data - stored on other systems (servers, SIEM tools, ISPs); subject to retention policies and rotation.
6. Physical configuration and network topology - documentation and layouts that rarely change.
7. Archival media - backup tapes, offline storage, CDs/DVDs; the least volatile.

A useful memory aid: start with what lives in the chip and the memory, then move to the disk, then to other systems, and finally to the archive on the shelf.

Why Volatile Data Is Valuable in Fraud Cases

Fraud examiners should appreciate what can only be found in live memory:
- Passwords and encryption keys for encrypted drives or files (if the machine is shut down, an encrypted volume may become permanently inaccessible).
- Documents or emails that are open but unsaved.
- Running malware or remote-access tools that may indicate an outside intruder (relevant when a suspect claims someone else used the machine).
- Active network connections showing data being transferred to external locations.
- Currently logged-in user accounts, which help attribute activity to a specific person.

How Digital Evidence Collection Works

The Fraud Examiners Manual stresses that fraud examiners generally should not perform forensic acquisitions themselves unless specifically trained. The examiner's role is to recognize digital evidence, secure the scene, protect the devices, and engage a qualified digital forensics specialist. Still, you must know the proper procedure.

Step 1 - Plan and obtain authority. Before seizing anything, confirm legal authority: company policy and employment agreements for employer-owned devices, consent, a subpoena, a search warrant, or a court order. Collecting data without authority can render it inadmissible and expose the examiner to liability. Identify in advance what devices and data sources exist (workstations, laptops, phones, servers, cloud accounts, removable media).

Step 2 - Secure the scene. Remove the suspect and other personnel from the area. Do not allow anyone to touch the computer. Photograph and video the scene, including the screen if the machine is on, all cable connections, and the back of the computer. Note the date and time displayed on the system and compare it to actual time.

Step 3 - Decide: powered on or powered off?
- If the device is off, leave it off. Never turn it on. Booting a computer alters hundreds of files, timestamps, and log entries, which can destroy evidence and undermine the integrity argument.
- If the device is on, do not touch the keyboard or mouse, do not browse through files, and do not shut it down normally without expert advice. A forensic specialist should capture volatile data (a memory image, running processes, network connections) using validated tools before power is removed.
- After volatile data is captured, the specialist decides how to power down. Pulling the plug (hard shutdown) prevents the operating system from running shutdown scripts that could overwrite data or trigger anti-forensic measures, and is commonly recommended for Windows workstations. A graceful shutdown may be preferred for servers and some operating systems where a hard shutdown could corrupt the file system. For laptops, remove the battery as well as the power cord.

Step 4 - Handle mobile devices properly. Phones and tablets should be isolated from networks so they cannot be remotely wiped or receive new data that overwrites old data. Place them in a Faraday bag or enable airplane mode if the device is accessible, and keep them charged so volatile data is not lost.

Step 5 - Create a forensic image. Original media should never be examined directly. The specialist attaches the drive through a hardware write blocker, which physically prevents any data from being written to the original, and creates a bit-stream (forensic) image - an exact sector-by-sector copy that captures not only active files but also deleted files, slack space, and unallocated space. A simple file copy or logical backup is not sufficient because it omits this hidden data.

Step 6 - Verify integrity with hashing. A hash algorithm (such as MD5, SHA-1, or SHA-256) generates a unique digital fingerprint for the original and for the image. If the two hash values match, the copy is proven identical. The hash is recorded in the documentation and can be recalculated later to show that the evidence has not changed. Remember: hashing proves integrity; it does not encrypt or hide data.

Step 7 - Work only on copies. All analysis is done on a working copy of the forensic image. The original device and the master image are stored securely and untouched.

Step 8 - Document and maintain the chain of custody. Every item is labeled (bagged and tagged) with a unique identifier, description, date, time, location, and the name of the person who collected it. The chain-of-custody log records every transfer of possession. Gaps in the chain allow opposing counsel to argue the evidence may have been altered.

Step 9 - Store evidence properly. Digital media should be kept in a secure, access-controlled location, protected from heat, moisture, static electricity, and magnetic fields. Access should be restricted and logged.

Common Mistakes That Destroy Digital Evidence
- Turning on a powered-off computer to 'take a quick look.'
- Opening files on the suspect's machine, which changes access timestamps.
- Shutting down a running system before volatile data is captured, especially where encryption is suspected.
- Copying files with standard tools rather than creating a forensic image.
- Allowing IT staff who are not forensically trained to recover data.
- Failing to isolate mobile devices from networks.
- Incomplete chain-of-custody documentation.

Exam Tips: Answering Questions on Volatility and Digital Evidence Collection

Tip 1 - Know the order of volatility cold. If a question asks which type of data is most volatile, the answer is CPU registers/cache or, among commonly listed options, RAM and running processes. If it asks which is least volatile, the answer is archival or backup media. If asked what should be collected first, choose the volatile data (memory, network connections, running processes) over the hard drive.

Tip 2 - When the computer is off, leave it off. Any answer option that involves turning on a powered-down computer to examine it is wrong. The correct approach is to photograph, document, and have a specialist image the drive using a write blocker.

Tip 3 - When the computer is on, do not shut it down immediately. The ACFE expects you to recognize that volatile data and possible encryption keys exist in memory. The best answer typically involves not touching the system and having a digital forensics expert capture volatile data before power is removed. Avoid options such as 'close all open programs and shut down normally.'

Tip 4 - Remember the role of the fraud examiner. Questions often test whether you know the limits of your expertise. Unless the examiner is trained in digital forensics, the correct answer is to secure the device and consult or engage a qualified digital forensics specialist, not to attempt recovery personally.

Tip 5 - Distinguish imaging from copying. A forensic (bit-stream) image captures everything, including deleted files and slack space. A logical copy of files does not. If a question asks for the proper way to acquire a hard drive, choose the forensic image made through a write blocker.

Tip 6 - Understand what hashing does. A hash value verifies that the image is identical to the original and that the evidence has not been altered. It does not encrypt, compress, or recover data. If answer options confuse these functions, eliminate them.

Tip 7 - Never analyze the original. Any scenario in which analysis is performed directly on the seized device rather than on a verified copy is a wrong answer.

Tip 8 - Chain of custody is always the answer to admissibility questions. If a question asks what documentation protects against claims of tampering, or why evidence might be excluded, think chain of custody: who collected it, when, where, and every hand it passed through.

Tip 9 - Watch for mobile device specifics. Isolation from networks (Faraday bag, airplane mode) and keeping the device powered are the key points. Remote wiping is the risk being prevented.

Tip 10 - Authority comes before action. If a scenario includes a question about whether to seize a device, confirm that legal authority or consent exists. Options that involve seizing personal devices without authority or accessing accounts without permission are incorrect.

Tip 11 - Read for the word 'first' or 'best.' Many CFE questions ask what should be done first. In digital evidence scenarios, the sequence is: secure the scene and obtain authority, document and photograph, capture volatile data (if powered on), then image non-volatile storage, verify with hashes, and maintain chain of custody. Pick the option that matches the earliest uncompleted step in that sequence.

Quick Review Summary
- Volatile data disappears at power-off; non-volatile data persists.
- Collect in order of volatility: registers and cache, memory and network state, temporary files, disk, remote logs, configuration, archives.
- Off stays off; on means do not touch and capture volatile data first.
- Use write blockers and bit-stream imaging; verify with hash values; analyze copies only.
- Isolate mobile devices; keep them powered.
- Document everything and preserve an unbroken chain of custody.
- Engage qualified digital forensics specialists; the fraud examiner's role is to recognize, protect, and coordinate.

Master these principles and you will be able to reason through virtually any volatility or digital evidence collection question the CFE Exam presents.