Which concept describes the data collection priority based on how quickly data can disappear from a system?

Which concept describes the data collection priority based on how quickly data can disappear from a system?

• A. Data retention policy
• B. Chain of custody
• C. Order of volatility
• D. Forensic imaging

Answer: (C)

Order of volatility is the principle that guides what you collect first, based on how quickly data can disappear. Volatile data lives in memory—RAM, running processes, open network connections, and encryption keys stored in memory—so it can be lost in an instant if the system loses power or is shut down. Because this information won’t remain available once the device is off, responders prioritize capturing it before anything else. After securing volatile data, you move on to non-volatile evidence like data on storage drives. Data retention policy deals with how long data is kept, chain of custody tracks who handled evidence, and forensic imaging is about making a bit-for-bit copy of storage for later analysis.

Order of volatility is the principle that guides what you collect first, based on how quickly data can disappear. Volatile data lives in memory—RAM, running processes, open network connections, and encryption keys stored in memory—so it can be lost in an instant if the system loses power or is shut down. Because this information won’t remain available once the device is off, responders prioritize capturing it before anything else. After securing volatile data, you move on to non-volatile evidence like data on storage drives.

Data retention policy deals with how long data is kept, chain of custody tracks who handled evidence, and forensic imaging is about making a bit-for-bit copy of storage for later analysis.