Explain the order of volatility and why it drives the sequence of evidence collection in DFIR.

When you arrive at a compromised host, the clock is already running on the evidence. The order of volatility (codified in RFC 3227) tells you to gather the data that disappears fastest first, so a careless reboot or shutdown does not erase the most valuable artifacts. Interviewers ask this to confirm you handle evidence methodically and understand what is lost when.

Most volatile to least

1. CPU registers, cache — gone in microseconds; rarely collected directly.
2. RAM and running state — live processes, open network connections, ARP cache, logged-on users, and injected/fileless malware and encryption keys that exist only in memory. This is why memory capture comes early.
3. Temporary files / swap / pagefile — transient but on disk.
4. Disk — the persistent file system; survives reboots but can be wiped or overwritten.
5. Remote logging and monitoring data — SIEM, NetFlow, off-host logs.
6. Archival media and backups — the most durable, collected last.

The key insight: memory before disk, disk before backups. Powering a box off to "preserve" it actually destroys the volatile tier — which is often where the real evidence of an active intrusion lives.

Doing it defensibly

Volatility order is only half the job. Work on forensic copies, not originals; compute and record cryptographic hashes before and after imaging to prove integrity; use write blockers for disks; and maintain an unbroken chain of custody documenting who handled each item, when, and why. Without that, evidence may be inadmissible.

Why this matters

A strong answer recites the rough sequence (registers → RAM/network → swap → disk → logs → backups), explains that shutting down loses the most fragile data, and pairs it with hashing and chain of custody. That shows you can preserve evidence under pressure in a way that holds up later.