Volatile state is data that exists only while a system is running or accessible in its current form. Common examples include RAM contents, active network connections, running processes, session tokens, temporary files, and some encryption keys. Once the device powers off, reboots, or the process ends, that information may be lost or may change during normal use.
In cyber security, volatile state matters because it often contains the clearest evidence of what a system is doing right now. Investigators may need to capture it before shutdown to preserve malware artifacts, injected code, command-and-control connections, or decrypted data. Defenders also use live memory and session analysis to spot intrusions that leave little trace on disk. Because accessing a running system can alter what is observed, volatile data must be collected quickly and carefully, with documentation that explains the method and any changes caused by the capture.