The Order of Volatility
What is it?
The order of volatility ranks evidence by how quickly it disappears: CPU state and network connections vanish in seconds, memory at power-off, temporary files at reboot, disk artifacts persist for months, and backups/logs may outlive the machine. Collection proceeds from most volatile to least.
Why it matters
Collecting in the wrong order destroys evidence with your own hands: an hour spent imaging the disk of a running machine is an hour its memory evidence had to survive — or not.
Where you see it
The collection plan of every live response: memory → volatile OS state → triage artifacts → disk.
What normal looks like
A collection log that starts with the RAM capture timestamp and works downward in volatility.
What suspicious looks like
Not applicable directly — this is collection discipline, not a finding.
How analysts investigate
By planning collection against the volatility ladder before touching the machine, so nothing transient is lost to sequencing.
Common beginner mistakes
- Starting with what is easiest to grab (files on the desktop) instead of what is dying fastest (memory and connections).
Wadi's analyst arrives at the running server with a plan written on one line: memory image → network connections and process list → triage artifacts → shut down → disk image. Ten minutes of discipline, and nothing volatile is lost.
Quick check
On a running, suspected-compromised host, which should be captured FIRST?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.