Order of Volatility

Quick Answer

Memory, running processes, network connections, then hard disk is the correct sequence because order of volatility ranks evidence types by how quickly they change or disappear, and the collection process has to work from most fragile to least fragile so nothing perishable is lost while less urgent evidence waits its turn. Memory sits at the top of that ranking because its entire contents vanish the instant the system loses power, and it can hold uniquely valuable evidence that exists nowhere else, such as encryption keys held only in memory or malware that runs entirely in RAM without ever touching disk. Running processes and network connections are the next tier of volatility: they can be captured through live analysis of the running system, but they change continuously and can terminate or disconnect at any moment, whether because a process naturally exits, an attacker notices detection and cuts off their session, or the system itself is disturbed. The hard disk comes last precisely because it's non-volatile; data written there persists through reboots and power loss, so it will still be available for imaging and analysis well after the more fragile, in-memory evidence would already be gone. This sequencing principle applies broadly any time a question asks about prioritizing evidence collection: always work from the most transient, memory-resident data down to the most durable, disk-based data.