Thank you very much for your post on memory analysis

Hello Kaushalkumar
Thank you very much for your post on memory analysis. You clearly explained the swap, volatile and nonvolatile memory. Swap memory is what computers use when they run out of RAM. When RAM is overused, some of its information is copied to swap memory. Typically swap memory is twice the size of the RAM. Forensics experts can retrieve contents of swap memory in case the computer is dead. Volatile memory is a memory that is only available when the computer is on. In case the computer is switched off. The temporary nature of the volatile memory does not keep information for the long term, and therefore it is a disadvantage to forensics experts. However, there are cases where the entire contents of RAM are copied to the hard discs making it easier for the forensics to retrieve it. Nonvolatile memory includes hard disks which do not lose information after the computer is lost.