Order of volatility

Also written: volatility

Collect evidence that disappears fastest first: memory, then disk, then remote logs and backups.

Where the book teaches it