Information that can be lost when a system is powered off or changes state, such as running processes, network connections, RAM contents, and certain encryption keys. Investigators balance volatile data capture with legal authority, safety, and evidence preservation requirements.
