Which artifact is commonly recovered from memory to aid digital investigations?

• A. Disk partitions
• B. Running processes
• C. Static code signatures
• D. Network logs

Answer: (B)

Volatile data in RAM captures the system state at a moment in time, including which programs are running. That snapshot is exactly what investigators need to understand active activity, identify malware, and reconstruct an incident timeline. Because of that, running processes are the artifact most commonly recovered from memory to aid digital investigations. Disk partitions live on storage devices, not in memory, so they aren’t recovered from RAM. Static code signatures are used to identify files and are stored separately rather than as live memory artifacts. Network logs are typically stored as log files on systems or devices, while memory may show current connections but the logs themselves aren’t memory artifacts.