Order of Volatility

The order of volatility is a guiding principle for evidence collection: capture the data most likely to disappear first, then work toward the most durable. Some evidence vanishes in microseconds, while other data survives for years, so the sequence in which you collect matters as much as what you collect.

Formalized in RFC 3227, a typical ordering runs from most to least volatile:

1. CPU registers and cache
2. RAM (running processes, network connections in memory)
3. Network state (routing tables, ARP cache, live connections)
4. Running processes and kernel state
5. Disk and file systems
6. Remote logging and monitoring data
7. Physical configuration and archival media

Following this order means acquiring a memory image before pulling the plug, since shutting down destroys RAM, open network sockets, and unsaved state. Respecting volatility maximizes the evidence recovered and preserves its integrity.