SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-order-of-volatility

When collecting evidence from a live compromised system, which data should you capture first?

The most volatile data, such as registers, cache, memory and the process table.

Start playing free

  1. Disk contents
  2. Archival backup media
  3. Memory, process table and ARP cache ✔

Why: Volatile data vanishes when power is lost or the system changes. RFC 3227 says to collect from the most volatile to the least volatile. Disks and archival media come later because they persist.

Huh, didn't know that: RFC 3227's example order starts with registers and cache, then routing and ARP tables, memory, temporary files and disk.

The dad joke
What do you get when you cross a computer with an elephant? Lots of memory!
Like this card?
Play the game

References

Answer: Memory, process table and ARP cache. Volatile data vanishes when power is lost or the system changes. RFC 3227 says to collect from the most volatile to the least volatile. Disks and archival media come later because they persist.

  1. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227
    When collecting evidence you should proceed from the volatile to the less volatile.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyAccording to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?Security & PrivacyWhat does a chain of custody record for digital evidence?Security & PrivacyIn digital forensics, what is a write-blocker used for?

That's stuff everyone should know.