Problem Statement
What is the correct order of volatility when collecting evidence?
Explanation
Forensic professionals collect data based on its volatility—starting from the most temporary to the most stable.
Memory and network data are collected first since they can change or disappear quickly, followed by disks, logs, and finally backups.