What is volatile digital evidence?¶

You have encountered a powered-on device, active account or live system. Some of the most useful evidence may exist only briefly and may disappear through power loss, disconnection, logout, timeout, restart or ordinary system activity.

Evidential caution: that digital evidence is permanent because it is stored electronically. Some records are durable, but volatile evidence can change from second to second or vanish completely when the live state ends.

What this means¶

Volatile evidence may include information held in memory, active user sessions, running processes, current network connections, open encrypted containers, unsaved documents, temporary files, command history, logged-in cloud access or tokens that keep an account available. On a phone, an unlocked state or active biometric access may also be short-lived. On a network, connection tables and security alerts may be overwritten quickly.

There is often a trade-off. Powering down may stop remote interference but destroy memory and active sessions. Leaving a system running may preserve access but allow continued change, remote deletion or battery failure. Disconnecting a network may contain harm but lose visibility of an attacker or interrupt business-critical services. The right decision depends on evidential value, operational risk, safeguarding, system type and available support.

What to check or do next¶

• Record what makes the evidence volatile, how long it may remain available, what could cause it to disappear, and what action was considered. If immediate intervention is necessary, document the reason and the expected evidential consequence.

Evidential limits¶

Volatility does not mean the first responder should immediately start capturing everything. Attempting a live capture without the right tools or competence can alter the system, contaminate evidence, trigger security controls or affect other users. The first task is to recognise the risk, record the visible state and obtain specialist advice quickly where the evidence may not survive.