Following the order of volatility principle, which evidence should you collect first?

• A. RAM memory dump and network connections
• B. Disk images
• C. Printed documents
• D. Email archives

Answer: (A)

Order of volatility prioritizes data that is most ephemeral, since it can disappear the fastest as soon as a system changes state or is powered off. RAM memory dump captures all currently active data: running processes, open memory-resident data, authentication credentials in memory, and encryption keys. This information is highly time-sensitive and can be lost in an instant if the machine is shut down or rebooted, so obtaining it first preserves crucial insight into what was happening in real time.

Live network connections are the next piece of volatile evidence, showing active sessions, open sockets, and ongoing communications. Recording these before the system changes ensures you can reconstruct who was talking to whom, when, and in what context, which is essential for timeline building and threat assessment.

Disk images, printed documents, and email archives are important for the broader, non-volatile evidence they provide, but they do not degrade as quickly as memory and live network state. They can be secured after the volatile data has been captured.