During a forensic investigation, an analyst must collect evidence from a running compromised Windows server. In what order should volatile data be collected following the order of volatility?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because the order of volatility runs from most to least volatile: CPU registers and cache (lost the fastest), RAM contents, network connections and routing tables, running processes, and finally disk contents. B is wrong because collecting the hard drive first preserves least-volatile data while most-volatile data is lost.
Full explanation below image
Full Explanation
A is correct because the order of volatility runs from most to least volatile: CPU registers and cache (lost the fastest), RAM contents, network connections and routing tables, running processes, and finally disk contents. B is wrong because collecting the hard drive first preserves least-volatile data while most-volatile data is lost. C is wrong because RAM contents are more volatile than network connections and must be collected first. D is wrong because the order should start with CPU registers before RAM.