During a forensic investigation, an analyst must collect evidence from a running compromised Windows server. In what order should volatile data be collected following the order of volatility?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — a is correct because the order of volatility runs from most to least volatile: CPU registers and cache (lost the fastest), RAM contents, network connections and routing tables, running processes, and finally disk contents. B is wrong because collecting the hard drive first preserves least-volatile data while most-volatile data is lost.
Full Explanation
A is correct because the order of volatility runs from most to least volatile: CPU registers and cache (lost the fastest), RAM contents, network connections and routing tables, running processes, and finally disk contents. B is wrong because collecting the hard drive first preserves least-volatile data while most-volatile data is lost. C is wrong because RAM contents are more volatile than network connections and must be collected first. D is wrong because the order should start with CPU registers before RAM.