RFC 3227

A published guide for collecting evidence, and the source of the order of volatility.

Where the book teaches it