Glossary: Incident Response and Resilience

order of volatility

Also written: volatility, volatile

The rule to collect the most short-lived evidence first: CPU registers and cache, memory, temporary files and swap, disk, remote logs, then backups. It comes from RFC 3227.