Lost immediately when power is removed 2. **Memory (RAM)** -- Contains running processes, network connections, encryption keys, malware in memory 3. **Network state** -- Active connections, routing tables, ARP cache 4. **Running processes** -- Process lists, open files, loaded modules 5. **Disk** --