Order of Volatility: Collecting Evidence in Correct Sequence
A forensic investigator is collecting evidence from a compromised Windows server. According to the order of volatility, which THREE pieces of evidence should be collected FIRST? (Select THREE)
Quick Answer
Running processes belong near the front of the collection order because they exist only in memory and volatile system state. The moment the system is powered down, rebooted, or even left running long enough for the process to exit, that evidence is gone permanently, unlike data written to disk which persists until it's actively overwritten. The order of volatility principle that governs forensic collection ranks evidence by how quickly it changes or disappears: the most fragile, transient artifacts have to be captured first, before less volatile sources like log files or the hard disk itself, precisely because those more durable sources will still be there later if collection has to be sequenced. Running processes sit alongside other memory-resident and connection-state data, such as active network connections, as some of the most time-sensitive evidence in an investigation, because an attacker's malicious process or an active command-and-control session can terminate or disconnect at any moment, either on its own or because the attacker notices they've been detected. Investigators use live-response tools to capture this kind of evidence with minimal disruption to the running system, rather than jumping straight to actions like powering off the machine, which would destroy exactly the evidence they're trying to preserve. Whenever a question invokes order of volatility, think in terms of what disappears fastest, meaning memory, processes, and active connections, and prioritize collecting those before anything durably stored on disk.
⚠ Common exam trap
ISC2 SSCP often tests the misconception that event logs are volatile because they are 'system state' data, but logs are written to disk and persist; the trap is confusing 'important' with 'volatile'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network connections and open ports
Network connections and open ports (C) are highly volatile because they can change rapidly and are lost when the system is disconnected from the network. Capturing this data first preserves evidence of active remote connections, which is critical for identifying the attacker's point of entry and ongoing malicious activity. Tools like netstat -anob or CurrPorts can be used to collect this information before any other forensic steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System event logs
Why it's wrong here
Event logs are stored on disk and are less volatile; they can be collected later.
- ✗
Hard drive image
Why it's wrong here
Hard drive is less volatile; should be collected after memory and network state.
- ✓
Network connections and open ports
Why this is correct
Current network state is volatile and can change rapidly.
- ✓
Contents of RAM (memory dump)
Why this is correct
Most volatile; contains running processes, network connections, encryption keys.
- ✓
List of running processes
Why this is correct
Processes are in memory and can be terminated; capturing them early is important.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a forensic investigation, a responder must collect evidence from a live Windows system. Which of the following represents the correct order for collecting volatile data?
hard- A.Disk image, memory dump, process list, network connections
- ✓ B.Memory dump, network connections, process list, disk image
- C.Process list, memory dump, disk image, network connections
- D.Network connections, memory dump, process list, disk image
Why B: Volatile data must be collected in order of decreasing volatility to avoid losing critical evidence. Memory (RAM) is the most volatile, followed by network connections and process lists (which change rapidly), and finally disk images (persistent storage). This order ensures that transient data is captured before it disappears.
Variation 2. An incident responder is collecting volatile evidence from a compromised Linux server. Which TWO of the following should be collected first? (Select two.)
medium- A.Disk image of the system drive
- B.System log files from /var/log
- C.Hardware configuration inventory
- ✓ D.List of active network connections using netstat
- ✓ E.Contents of RAM using LiME
Why D: In incident response, volatile data is data that will be lost when the system is powered off. Active network connections (captured via netstat) and the contents of RAM (captured via LiME) are the most volatile, as they change constantly and are lost immediately upon shutdown. Collecting these first preserves critical evidence of current attacker activity and in-memory artifacts like rootkits or encryption keys.
Variation 3. An incident responder is collecting evidence from a compromised server. Which of the following is the correct order for collecting volatile data?
medium- A.Network connections, memory dump, disk image
- B.Disk image, network connections, memory dump
- ✓ C.Memory dump, network connections, disk image
- D.Disk image, memory dump, network connections
Why C: Volatile data must be collected in order of decreasing volatility: memory (RAM) is most volatile and lost on power loss, followed by network connections (ephemeral state), and finally disk image (persistent storage). This order ensures critical evidence like running processes, encryption keys, and active network sessions are captured before they disappear.
Variation 4. Which of the following is the FIRST step in the volatile evidence collection order when responding to an incident on a live system?
easy- ✓ A.Capture a RAM dump using a tool like Magnet RAM Capture or WinPmem
- B.Disconnect the system from the network
- C.Run antivirus scans to identify malware
- D.Create a forensic image of the hard drive
Why A: Volatile evidence is collected starting with the most volatile (memory) to preserve data that can be lost when the system is powered down. RAM dump must be done first.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.