---
{
  "title": "Order of volatility",
  "summary": "Prioritize evidence that is likely to disappear first, with context.",
  "topic": "forensics",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    1
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Integrating Forensic Techniques into Incident Response",
      "url": "https://csrc.nist.gov/pubs/sp/800/86/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Order of volatility helps prioritize collection based on how quickly evidence may change or disappear. Memory, active connections, temporary state, and short-retention records may need attention before persistent storage. It is a planning aid, not a rigid instruction to collect everything immediately. Authorization, safety, tools, encryption state, and business impact influence the decision. Record why a particular collection order was chosen.

## In practice

A live system holds useful process and connection information that will disappear on shutdown. The investigator considers approved memory capture before turning it off.

## A common misunderstanding

Powering off is not always the best first step; it can destroy volatile evidence or make encrypted storage harder to access.

## Check your understanding

What should accompany a choice not to collect volatile data?

**Think it through:** A documented reason and an explanation of the resulting limitation.


## Prioritize evidence by likely loss and practical value

Volatile evidence can disappear as processes end, connections close, systems restart, or retention windows expire. Prioritization should consider how quickly a source changes, how important it is to the investigative question, and the effect of collection. A memorized list is a starting point, not a substitute for understanding the actual environment.

Some evidence is remote or centrally retained. A cloud audit log nearing expiry may be more urgent than stable local storage, while a fragile running process may require immediate attention. Collection also has consequences: a tool can alter state or affect a critical service. Coordinate decisions with authorized responders and document the tradeoff.

## A fictional unstable workstation

An academy investigates a workstation making unusual connections. The team considers memory, live connection context, endpoint logs, and central network records. It also knows the device may restart for an update. The chosen plan records why certain sources were prioritized and what could not be collected safely.

If containment requires disconnecting or shutting down the device, explain the evidence impact rather than pretending preservation and business protection never conflict. Other sources may partially compensate for lost volatile state. A defensible investigation documents those limits and avoids a universal rule that ignores service safety or operational consequences.

## Rank a fictional evidence set

List a running process, a short-lived cloud log, a disk image, and a supplier record with a known retention deadline. Rank collection priorities for a specified question and explain each choice. Then change the scenario so the system supports a critical live service. Reconsider the plan and identify who should authorize the tradeoff. The reasoning matters more than reproducing a fixed order.

## Keep exploring

- [[memory-forensics]]
- [[evidence-acquisition]]
- [[containment]]