Order of Volatility.

The acquisition priority defined by RFC 3227 that requires forensic responders to collect the most ephemeral evidence first, before it is overwritten or lost. It belongs to the Forensics & IR category of cybersecurity.

The acquisition priority defined by RFC 3227 that requires forensic responders to collect the most ephemeral evidence first, before it is overwritten or lost.

Order of volatility is a foundational DFIR principle, codified in RFC 3227, that ranks digital evidence by how quickly it changes or disappears. The canonical order is: CPU registers and cache, kernel and process memory, network state and ARP caches, running processes, temporary file systems, persistent storage, remote logging and monitoring data, and finally physical configuration and archival media. Responders must image volatile sources before powering off or rebooting, because RAM, network sessions, and routing state are destroyed at shutdown. In modern Windows incident response this typically means capturing memory with WinPmem or DumpIt and triaging volatile artifacts with KAPE or Velociraptor before live forensic shutdown procedures.

Defences for Order of Volatility typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Volatility order, RFC 3227 order.