We are now stepping out of the “Dead Box” world of hard drives and entering the high-pressure environment of Live Response. In Section 1, we learned how to recover “ghosts” from physical platters—data that stays put even when the power is cut.
But in a modern cyber-attack, the most critical evidence lives in the RAM (Random Access Memory). This data is “volatile”—it exists only as long as electricity is flowing through the circuits. If you pull the power plug before capturing it, the encryption keys, running malware, and chat logs vanish into thin air.
1. The Digital Life-Expectancy (RFC 3227)
Digital evidence has a “life expectancy”. As an investigator, you must collect evidence starting with the most fragile data first. This is known as the Order of Volatility.
| Priority | Data Source | Volatility Level | Why it’s Fragile |
| 01 | CPU Registers & Cache | Extreme | Changes nanosecond by nanosecond. Almost impossible to capture manually. |
| 02 | RAM (System Memory) | High | Contains active malware, decrypted passwords, and open network sockets. Lost instantly on power loss. |
| 03 | Network State | Medium | Current connections (ESTABLISHED) can be closed by the attacker remotely. |
| 04 | Hard Drive (Disk) | Low | Data persists without power. This is what we studied in Section 1. |
2. The Golden Rule: Don’t Kill the Process
In the “old days” of forensics, the first step was “Pull the Plug” to prevent the computer from wiping itself. Today, that is considered forensic malpractice. If a drive is encrypted with BitLocker, the “Key” is sitting in the RAM. Pull the plug, and you lose the key—making the drive unreadable forever.
Interactive Lab: [root@ocsaly ~]# live_response –triage –timer-active
MISSION: You have just entered an office where a suspect’s laptop is unlocked. A “Wipe Script” has been detected in the process list. You have limited time to collect evidence before the system crashes or the attacker disconnects.
Task: Click the evidence sources in the Correct Order of Volatility. If you pick a “Stable” source before a “Volatile” one, the volatile data will be lost.
[INTEL] Attacker is active. Volatile data is degrading.
3. The Consequences of Order
In the lab above, why is the CPU Register the highest priority? Because every time you move the mouse or type a command to “save” data, you are overwriting the registers.
- CPU Cache/Registers: Gone in nanoseconds.
- RAM: Gone the moment the power fails.
- Network Connections: Attacker can “Kill” the connection once they realize they are being investigated.
- Disk Storage: The “Sectors” and “Clusters” we studied in Section 1. These are stable and can wait until the RAM is safe.
4. The Volatility of CPU States & Cache
At the absolute top of the order (Priority 01) are the CPU Registers and Cache. This is the “brain’s immediate thought”.
- Registers: Smallest, fastest storage inside the CPU itself. It holds the exact instruction being executed right now.
- L1/L2 Cache: Temporary storage that keeps frequently used data close to the processor.
- The Forensic Challenge: Even running a “Forensic Tool” to capture this data changes the data itself.
5. Network State and Socket Interrogation
Priority 03 involves Network Connections and Routing Tables. If a suspect is using a Reverse Shell to communicate with a Command & Control (C2) server, that connection only exists in the system’s “active state”.
- Established Connections: Shows IP addresses of remote attackers.
- Listening Ports: Reveals hidden backdoors or unauthorized services.
- ARP Cache: Maps IP addresses to MAC addresses on the local network, helping identify other compromised machines in the building.
6. The Danger of “Pulling the Plug” (Modern Encryption)
In Section 1, we learned about imaging the “Dead” disk. However, in Section 2, we must acknowledge the BitLocker/FileVault trap.
- The Key in RAM: When a drive is encrypted, the decryption key is loaded into the RAM while the computer is on.
- Power Loss = Data Loss: If you cut the power (the old-school way), the key is wiped from RAM. The physical disk becomes a “brick” of encrypted noise that cannot be solved even with a supercomputer.
- The Rule: Capture the RAM before the system is powered down or moved.
Why the Order is the Law
If you pick the Physical Disk (Priority 4) before the CPU Registers (Priority 1), you’ve lost the immediate state of the processor. In a real incident, an attacker might have a “dead man’s switch” that clears the RAM if the disk is tampered with. By following the Order of Volatility, you ensure that even if the system crashes halfway through, you’ve already secured the most fragile evidence.