Volatile data
Also known as: Flüchtige Daten, live data, memory forensics
Information that exists only while a system runs – memory, network connections, processes, session keys – and is lost on shutdown.
Many attacks leave little on disk and everything in memory: decrypted malware, credentials, live connections to the attacker. Switching off a compromised system destroys those traces. The order of acquisition therefore follows volatility: memory and network state first, storage second. Cloud services sharpen the problem because data there can be deleted or overwritten automatically, beyond the company's control.