Glossary: Security+ Exam Prep 2: Performance-Based Questions

order of volatility

Collecting evidence from the most short-lived first: memory, then temporary files, then disk, then backup tapes.