Glossary: Logs and Data Sources for Investigations

Order of volatility

Also written: volatile, volatility

The rule of collecting the shortest-lived evidence first, from CPU registers and memory down to disk and backups, as listed in RFC 3227. In practice you capture memory before the disk.