Ephemeral Data

Information that is temporary or volatile, and could be lost over time, is referred to as ephemeral data.

Ephemeral data includes:

• Items flagged for deletion but not yet deleted by the Operating System
• Temporary messages in chat applications
• “Recent” lists such as call history or lock screen notifications

For projects involving ephemeral data, response time and data preservation are critical concerns for evidence collection.