ExamWizardzExamWizardz
Start free
Security

What is order of volatility?

The order of volatility is the sequence for collecting digital evidence from most to least volatile, so short-lived data such as RAM is captured first.

What is the order of volatility?

The order of volatility is the sequence in which investigators collect digital evidence: the most volatile, shortest-lived data first, and the most durable last. Some evidence disappears the instant a computer loses power, some changes within seconds while the system keeps running, and some lasts for years. Collecting in the wrong order destroys evidence that can never be recovered. The best-known statement of the principle is RFC 3227, Guidelines for Evidence Collection and Archiving.

The order, from most to least volatile

RFC 3227 lists these tiers for a typical system:

  1. CPU registers and cache: change constantly and are rarely captured in practice.
  2. Routing table, ARP cache, process table, kernel statistics and memory (RAM): lost at power-off and changing every second.
  3. Temporary file systems: such as temp directories held in memory or cleared at reboot.
  4. Disk: survives power-off, but continued use overwrites deleted data and changes timestamps.
  5. Remote logging and monitoring data: logs on a SIEM or syslog server, subject to retention limits.
  6. Physical configuration and network topology.
  7. Archival media: backups and archives, built to last.

Other references arrange the middle tiers slightly differently, for example listing network connections and running processes as separate steps after memory. Network state and the process list live in memory, so a full memory capture preserves much of them. The principle stays the same: collect what you will lose soonest, first.

Example: responding to a running, compromised server

An EDR alert shows a web server running a malicious process that has never written a file to disk. The responder:

  1. Isolates the server from the network through the EDR console instead of powering it off, so the attacker loses access but RAM is preserved.
  2. Captures a full memory dump with a trusted tool run from external media, writing the output to an evidence drive, never to the server's own disk.
  3. Records live network and process state, for example with netstat -ano and tasklist /v on Windows or ss -tunap and ps auxww on Linux, saving each output and noting the time.
  4. Images the disk, or takes a snapshot if the server is a virtual machine.
  5. Exports the relevant logs from the SIEM and secures the backups.

Every item is hashed when collected and logged on a chain of custody form. Each command run on a live system changes it slightly, so responders keep live commands to a minimum and record every one.

Common mistakes

  • Pulling the power or rebooting first, which wipes RAM, including fileless malware, encryption keys and live connections.
  • Imaging the disk before capturing memory because disk imaging is more familiar.
  • Saving tool output to the suspect system's own disk, which can overwrite deleted files in unallocated space.
  • Waiting too long to export logs, so the oldest entries roll off under normal retention.

There are exceptions. If ransomware is actively encrypting data and isolation isn't possible, stopping the damage can outweigh preserving memory. The order of volatility guides collection; it doesn't override the need to contain an active threat.

Order of volatility vs. chain of custody

The two are often paired in questions, but they answer different things. The order of volatility decides what to collect first. Chain of custody documents who held each item after it was collected. Hashing proves an item hasn't changed, and a legal hold stops routine deletion when litigation is expected.

Order of volatility on the CompTIA Security+ exam

The order of volatility is tested in objective 4.7 on SY0-801, as part of the investigation phase of incident response, and in objective 4.8, which covers memory dumps, disk images and snapshots. A question that asks what to collect FIRST from a running system wants the most volatile item in the answer list, which is usually memory (RAM), or CPU registers and cache if they are listed. Disk images, logs and backups are the tempting wrong answers because they are familiar, but they will still be there after memory is gone. If a scenario mentions fileless malware, encryption keys in use or a system that is still running, capture memory before anything else.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

chain of custody

Chain of custody is the documented, unbroken record of who collected, handled, transferred and stored a piece of evidence, when, and why.

digital forensics

Digital forensics is the collection, preservation and analysis of digital evidence using documented methods so its findings hold up to legal scrutiny.

file hashing

File hashing is a cryptographic technique that generates a unique fixed-length string of characters (hash value or digest) from a file's contents, enabling verification of data integrity and authenticity without encryption. Any change to the file, no matter how small, produces a completely different hash, making it impossible to modify a file undetected.

fileless malware

Fileless malware runs in memory and abuses built-in tools such as PowerShell and WMI instead of dropping an executable, so file scans often miss it.

incident response

Incident response is the set of steps for handling a security breach, malware or prohibited content: identify, report, preserve evidence and document.

← Back to the full CompTIA glossary