Types of Digital Evidence

The Digital Evidence is divide into two categories, which is volatile and non volatile data.

a) Volatile Data:

• The evidence on a system Don't last long.
• Some evidence resides in storage that requires a consistent power supply (such as RAM).
• other evidence may be stored in information that is continuously changing.
• When collecting evidence, you should always try to proceed from the most volatile to the least.
• Once you have collected the data from volatile sources you may be able to shut down the system.

b) Non-Volatile Data:

• The evidence on a system last long.
• Stored on a storage device such as a hard drive or flash memory.
• The format for this type of data is static.