Glossary: Security Operations and Incident Response

Order of volatility

Also written: volatility

The rule to collect the most short-lived evidence first: registers and cache, then memory and network tables, temporary files, disk, remote logs, physical layout, and finally archival media such as backups.