Order of volatility
- Term
- Order of volatility
- Exam
- CISA & CISM
- Definition
Collecting the most short-lived evidence first, such as memory before disk.
- Explained
Investigators collect the most short-lived evidence first: memory and network state before disk. Powering down a system first destroys volatile evidence.
- In practice
Capture memory and network connections before imaging the disk.
- Often confused with
- Chain of custody
- Exam angle
Capture memory before powering a system down.
- Related