What is the order of volatility in forensics?
D4 · Operations · CompTIA Security+ SY0-701The order of volatility defines the sequence in which forensic evidence should be collected — most volatile (disappears quickest) to least volatile (persists longest).
Order (most → least volatile):
1. CPU registers, cache
2. RAM (system memory)
3. Swap/page file
4. Network connections, routing tables
5. Running processes
6. Disk storage
7. Remote logging / monitoring data
8. Physical configuration, network topology
9. Archival media (backups, tapes)
Order (most → least volatile):
1. CPU registers, cache
2. RAM (system memory)
3. Swap/page file
4. Network connections, routing tables
5. Running processes
6. Disk storage
7. Remote logging / monitoring data
8. Physical configuration, network topology
9. Archival media (backups, tapes)
RAM is the most important volatile source — it contains active encryption keys, malware, passwords, and network connections. If a system is powered off, RAM data is lost. Always capture memory (RAM) before shutting down a compromised system.