CompTIA Security+ Question J-38

Which of the following is the LEAST volatile when performing incident response procedures?

A. Registers
B. RAID cache
D. Hard drive

Answer: D

An example of OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts. Of the options stated in the question the hard drive would be the least volatile.