Order of Volatility
Definition
The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and cache are most volatile; optical media and printed logs are least volatile. Responders collect in this order to avoid losing evidence that disappears when power is removed or processes terminate.
- Standardized in
- RFC 3227 (2002)
- Most volatile source
- CPU registers and cache
- Least volatile source
- Physical archives
Common questions
What is the order of volatility?+
The order of volatility is a ranking of digital evidence sources from most to least likely to vanish. It guides forensic examiners on what to capture first during an investigation. The ranking, standardized in RFC 3227 (2002), starts with CPU registers and cache (most volatile) and moves down to physical archives (least volatile).
Why does the order of volatility matter in digital forensics?+
Data in memory disappears when power is lost or systems are shut down. Data on disk persists longer. By following the order of volatility, examiners capture the most perishable evidence first, before it can be lost. This prevents critical evidence from vanishing during the investigation process.
What's the typical sequence for collecting evidence by volatility?+
Start with CPU registers and cache, then routing and process tables, then RAM, then temporary file systems, then disk storage, then remote logs, and finally physical archives. This sequence ensures transient data in memory is preserved before moving to more persistent sources.
Related terms
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Live Response
- The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would...
- ARP Cache
- A table held in memory that maps IP addresses to hardware (MAC) addresses for recently contacted hosts on the local network. ARP...
- BIOS / UEFI
- Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is...
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Chipset (PCH)
- The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub;...
- CMOS Battery
- A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged....
- Computer Forensics
- Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline:...
Explained in these topics
- Computer Forensics: Cyber Crimes, Digital Evidence, Seizure and AcquisitionRFC 3227 (2002) ranking that dictates collection order: registers and cache, then routing and process tables, then RAM, then temporary file systems, then disk,...
- Computer Hardware Fundamentals for Forensic ExaminersThe forensic ranking of memory locations from most-likely-to-vanish to most-persistent: CPU registers and cache, RAM, network and routing state, temporary file...
- The Digital First Responder: Order of Volatility, Seizure and ImagingThe ordering of evidence sources from most to least volatile, used to decide what to capture first. Codified in RFC 3227 (2002).
- Evidence Preservation During ContainmentThe sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and cache are most volatile...
- Forensic Readiness and Response ToolkitsThe sequence in which evidence sources should be collected, ranked from most to least fragile. RAM is collected first (lost at power-off), followed by network...
- Live Network State and Process CaptureA ranking of digital evidence by how quickly it changes or disappears. Formalised in RFC 3227, it runs from CPU registers and memory (most volatile) through ne...
- Memory Acquisition and Analysis in Incident ResponseA prioritisation principle from RFC 3227 (2002) that ranks evidence sources by how quickly their contents are lost. RAM is the most volatile (cleared on shutdo...
- What Is Cyber ForensicsThe principle that digital evidence must be collected in order from most transient to most stable. RAM contents are lost on power-off; network connections clos...