True or False: Volatile information can be easily modified or lost when the system is shut down or rebooted.

• A. True
• B. False
• C. Not Applicable
• D. Cannot Determine

Answer: (A)

Volatile memory, like RAM, holds data only while the system is powered. It is the fastest, most writable storage the system uses for active processes, so its contents are continually being read from and written to. Because of this, information stored there can be easily modified during normal operation by running programs or malware. When the system is shut down or rebooted, power is removed and the volatile data is erased, so what was in memory is lost. This transient nature is why volatile data is a key target for live forensic collection—you want to capture it before shutdown. One caveat: if the system uses hibernation, memory contents are saved to disk and can persist across shutdowns, but in standard operation without hibernation, the statement holds true.