← Security+ glossary

Order of volatility

A rule by which evidence is collected from the most volatile to the most durable, so the contents of RAM and running processes are collected first, and only then the data from disk. It is followed so that evidence is not lost or unintentionally altered during the investigation.

All Security+ guides →