Order of volatility: what evidence to collect first during an incident

The order

RFC 3227 lists evidence from most to least volatile: registers and cache; routing table, ARP cache, process table, kernel statistics, and memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; and archival media. Collect the most volatile items first, because they disappear when a machine is rebooted, isolated, or simply keeps running.

In practice

For most responders, the practical sequence is: capture memory, collect live system state (processes, network connections, logged-in users, scheduled tasks), collect key logs and triage artifacts, then image or snapshot the disk if needed. On cloud VMs, take a disk snapshot through the provider API, which is fast and does not require logging in.

Containment may need to happen before full collection, such as when an attacker is actively encrypting files. Make that decision deliberately and record it.

Lab: plan a collection

For a lab Windows VM suspected of compromise, write the exact order of collection with the tool for each step and where the output goes. Then do it: acquire memory with a tool such as WinPmem or DumpIt to an external drive, run a live triage collection, export the Security and Sysmon logs, and take a VM snapshot. Hash every output file and record the times.

# example outline (Windows lab VM, outputs to E:\case-014)
winpmem_mini_x64.exe E:\case-014\mem.raw
Get-Process | Select Id,ProcessName,Path,StartTime | Export-Csv E:\case-014\proc.csv -NoTypeInformation
Get-NetTCPConnection | Export-Csv E:\case-014\net.csv -NoTypeInformation
wevtutil epl Security E:\case-014\Security.evtx
wevtutil epl Microsoft-Windows-Sysmon/Operational E:\case-014\Sysmon.evtx
Get-FileHash E:\case-014\* -Algorithm SHA256 | Export-Csv E:\case-014\hashes.csv -NoTypeInformation

Things to avoid

Do not run unknown tools from the suspect disk, install software on it unnecessarily, or browse its files casually, because every action changes timestamps and memory. Write collection output to external or network storage, not the suspect system.