During a forensic investigation, an analyst must collect evidence from a running compromised Windows server. In what order should volatile data be collected following the order of volatility?
Select an answer to reveal the explanation.
Short Explanation
When you collect volatile data, you go from most to least volatile. Start with CPU registers and cache, then RAM contents, then network connections, then running processes. Slower-changing data, like disk contents, comes later.
Full Explanation
The correct sequence is CPU registers and cache, then RAM contents, then network connections and routing tables, then running processes, then disk contents, because volatility runs from most to least volatile. Starting with a hard drive image, then memory dump, then active network connections is wrong because it preserves least-volatile data while most-volatile data is lost. Starting with network connections, then running processes, then RAM contents, then disk image is wrong because RAM is more volatile than network connections and must be collected first. Starting with RAM contents, then running processes, then network connections, then hard drive image is wrong because CPU registers must be collected before RAM.