Which statement about evidence collection order is accurate?

• A. The most volatile data should be collected first, then less volatile data
• B. Always collect all data before any analysis
• C. Data should be collected only from the host experiencing the incident
• D. Volatility is not a consideration in evidence collection

Answer: (A)

Volatility drives the order in which you collect evidence. The most volatile data is things like memory contents (RAM), live process lists, open network connections, and transient caches. These artifacts exist only while the system is running and can disappear within moments if the machine is powered down or the state changes, so capturing them first preserves crucial, time-sensitive information such as running malware in memory, encryption keys in use, and the current network activity.

After you’ve secured that ephemeral data, you move on to less volatile data such as disk images, logs, and configuration files that persist longer and can be analyzed later without the same urgent risk of loss. This approach helps create a faithful snapshot of the system’s state at the incident moment and supports more reliable reconstruction and analysis.

The other statements don’t fit because collecting all data before any analysis can delay response and allow volatile data to vanish; collecting data from only one host can miss evidence on other involved devices; and volatility is indeed a critical factor in planning evidence collection.