RFC 3227
Definition
Guidelines for Evidence Collection and Archiving, published by the IETF in February 2002. It defines the order of volatility, the documentation requirements for live evidence collection, and the principle that the collection process should alter evidence as little as possible.
- Publisher
- IETF
- Published
- February 2002
- Full title
- Guidelines for Evidence Collection and Archiving
- Core principle
- Order of volatility, minimal alteration during collection
Common questions
Is RFC 3227 legally binding on investigators?+
No, it is a best-practice guideline rather than a legal standard, but courts and forensic accreditation bodies commonly reference its principles, such as order of volatility and minimal-alteration collection, as evidence of sound methodology.
What does the order of volatility in RFC 3227 rank first for collection?+
It ranks data by how quickly it disappears if not captured, placing registers and cache first, followed by routing tables, ARP cache, and process tables, then memory, before moving to slower-to-change items like disk and remote logging data.
Has RFC 3227 been superseded by newer forensic standards?+
It has not been formally superseded as an IETF document, but many organisations now supplement it with newer, more detailed frameworks and ISO forensic standards that build on its core order-of-volatility and chain-of-custody principles.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Live Response
- The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would...
- Memory-Resident Malware
- Malicious code that executes entirely in RAM and writes no files to disk. Fileless malware, PowerShell-based loaders, and certain rootkits fall into...
- Non-Volatile Data
- Data that persists without power, such as files on a hard disk, SSD, or optical media, and data in non-volatile memory chips....
- Volatile Data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...