Skip to content

LSA 2: Identify Order of Volativity

The Order of Volatility is a principle in digital forensics that dictates the sequence in which digital evidence should be collected based on its likelihood of being altered, overwritten, or lost. It emphasizes the importance of prioritizing the most transient data that can quickly disappear or become inaccessible. This principle ensures that forensic investigators capture the most perishable evidence first, preserving the integrity of the investigation. The concept stems from the fact that data stored in volatile memory, for example, is much more susceptible to changes compared to data on more persistent storage media like hard drives or archival tapes.

The following is the typical order of volatility from most to least volatile:

  1. CPU Registers and Cache:

  2. These are small, high-speed storage areas within the CPU designed to hold frequently accessed data and instructions. Due to their proximity to the processor, their contents change extremely rapidly (often in nanoseconds). If not captured immediately, this data is lost as soon as the system is powered off or the CPU is reset.

  3. RAM (Random Access Memory):

  4. RAM is volatile memory that stores data temporarily while a computer is running. It contains data such as open applications, system processes, and unsaved user data. Once power is lost, all contents of RAM are erased. Therefore, this is typically the second most volatile data to collect in the forensic process.

  5. Swap Files and Paging Files:

  6. These are virtual memory components that help manage system resources by swapping data between RAM and the hard drive. In cases where the system runs low on memory, parts of active programs or data are written to the disk. While not as volatile as RAM, these files can still change rapidly, especially when there is heavy system activity.

  7. Disk Storage (Hard Drives, SSDs, External Drives):

  8. Data stored on physical drives is less volatile than memory or swap files. Although hard drives and SSDs are non-volatile, data on these devices can still be altered or overwritten, especially in systems with active users. In forensics, it is still considered less volatile compared to memory, but it is important to acquire disk data as soon as possible to prevent it from being modified.

  9. Network State:

  10. This includes active network connections, routing tables, and active network sessions. While not as volatile as RAM, network state data is dynamic and can change quickly as systems communicate over the network. Collecting this data while the system is still running and connected to the network is important for understanding the current system activity.

  11. Logs and Backups:

  12. System logs, application logs, and backups tend to be less volatile but still should be gathered during a forensic investigation. Logs may provide historical insights into system events and user activity, while backups can offer valuable evidence of system configurations or data states at different points in time. While they may not change quickly, they are still essential for building a case and should be preserved as soon as possible.

  13. Archived Media and Other Stored Evidence:

  14. Data stored on archival media such as DVDs, tapes, and other forms of backup is the least volatile. Since these media are not typically altered during normal system operations, the data remains stable and can be retrieved later in the forensic process. Archival data is still important, but it does not have the same immediacy as more volatile evidence.

IETF RFC 3227 - Guidelines for Evidence Collection and Archiving

The Internet Engineering Task Force (IETF) RFC 3227 provides best practices and guidelines for the collection and archiving of digital evidence. According to the IETF's recommended practices, the standard order of volatility should be followed to ensure that critical evidence is not lost during the acquisition process. The key guidelines for evidence acquisition outlined in the RFC are:

  1. Registers and Cache:

  2. The contents of CPU registers and cache are highly volatile and should be collected first. These are the most ephemeral form of evidence, and their contents can change in fractions of a second. Tools like memory dump utilities are used to capture this evidence before it is overwritten or lost.

  3. Routing Tables, ARP Cache, Process Tables, Kernel Statistics, Memory:

  4. These elements are part of the system's runtime state, and while they can provide critical insights into system activity and processes, they are subject to rapid changes. For example, routing tables or process tables contain information about network connections and running processes, which could be altered as the system continues to operate. Data from RAM should be collected as soon as possible, as it can be lost during a system shutdown or power disruption.

  5. Temporary File Systems:

  6. Temporary files (like cache files or session data) are less volatile than memory or registers but can still hold significant evidence. These files are often used for short-term storage by operating systems and applications and may contain valuable data related to the case at hand. However, they persist longer than highly volatile data like RAM, making them slightly less time-sensitive.

  7. Disk Storage:

  8. Data stored on hard drives, SSDs, and other storage devices is much more persistent than volatile memory. However, it still needs to be collected quickly to prevent overwriting. The likelihood of data being lost from disk storage is lower compared to volatile memory, but it is still possible, especially if the device continues to be used after the incident.

  9. Remote Logging and Monitoring Data:

  10. Logs and remote monitoring data are useful in understanding the history and activities of the system but are generally less volatile than on-device memory or file systems. This data can be collected once the more volatile evidence is secured.

  11. Physical Configuration and Network Topology:

  12. Information regarding the physical setup of systems and network architecture may help with context but is less urgent in the evidence collection process. This data typically includes information about connected devices, network layouts, and configurations, which may be useful for reconstructing the environment but doesn't carry the same immediacy.

  13. Archived Media:

  14. Data stored on archival media (e.g., DVDs, tapes, long-term backups) is the least volatile and is usually preserved for long periods. While this data can provide historical context, it does not need to be gathered immediately as part of the evidence acquisition process.

By following these guidelines and prioritizing the collection of the most volatile data, forensic investigators ensure that the most crucial evidence is preserved and available for legal and investigative purposes.

Importance of Following the Order of Volatility

Following the order of volatility when collecting digital evidence is critical to maintaining the integrity, authenticity, and completeness of the investigation. By prioritizing the most volatile data, forensic examiners ensure that they capture the most crucial and time-sensitive evidence first. Below are the key reasons why adhering to this principle is essential:

1. Data Preservation

  • Preservation of volatile data: Volatile data, such as contents in CPU registers or RAM, is constantly changing and can be lost with even small events like a system reboot or power loss. By following the order of volatility, examiners ensure that this data is captured first, preventing it from being overwritten or lost entirely.
  • Prevents evidence tampering: Collecting volatile data early reduces the risk of accidental modification or destruction of evidence, which could compromise the investigation and legal validity.

2. Integrity

  • Ensures authenticity: The chain of custody and evidence integrity are paramount in forensics, especially when presenting findings in a legal context. Collecting the most volatile data first helps prevent any inadvertent changes to evidence that could undermine its integrity.
  • Verification through hashes: Evidence collected using the proper order of volatility is more easily verified through cryptographic hashes, ensuring that the collected data remains unchanged from the moment it was captured.

3. Efficiency

  • Optimizes time and resources: By starting with the most volatile evidence, examiners can focus their attention on the most important data, minimizing the time spent on less critical items. This ensures that resources are directed efficiently and effectively during the investigation.
  • Prioritizes critical evidence: Not all data is equally time-sensitive. Following the correct order ensures that the most critical evidence is secured first, helping to expedite the forensic analysis and decision-making process.

4. Comprehensiveness

  • Complete and accurate system image: By adhering to the order of volatility, examiners can create a comprehensive forensic image of the system state, capturing a holistic view of the system's memory, processes, and activities at the time of the incident. This ensures no critical data is missed.
  • Holistic view for investigation: A complete collection of volatile and non-volatile data provides a more complete timeline of events and activities, enhancing the overall forensic investigation.

In summary, following the order of volatility helps ensure a thorough, effective, and legally sound forensic process. It not only preserves the critical data and maintains its integrity but also helps forensic investigators work efficiently while ensuring that the collected evidence can stand up to legal scrutiny.

This section highlights why adhering to the order of volatility is a fundamental practice in digital forensics. It emphasizes the critical aspects of data preservation, integrity, efficiency, and the completeness of an investigation.