Problem Statement
During evidence collection, which order of volatility is the most appropriate?
Explanation
Volatile data disappears first. Capture the most short-lived artifacts early: CPU state and memory, then process lists, connections, and live network data. Disk images and backups come later because they persist. Following this order preserves the best evidence for root-cause analysis.
