Which of the following activities should a forensic examiner perform FIRST when determining the priority of digital evidence collection at a crime scene?

The correct answer is B. Establish order of volatility. The order of volatility refers to the priority in which digital evidence should be collected based on how long it remains intact or how quickly it can be altered or destroyed. The key principle is that evidence that is most volatile (e.g., data in RAM, running processes, or…

Submitted by amina.ke· Mar 5, 2026Security Operations

Question

Options

AGather physical evidence,
BEstablish order of volatility.
CAssign responsibilities to personnel on the scene.
DEstablish a list of files to examine.

How the community answered

(41 responses)

A
2% (1)
B
93% (38)
D
5% (2)

Explanation

The order of volatility refers to the priority in which digital evidence should be collected based on how long it remains intact or how quickly it can be altered or destroyed. The key principle is that evidence that is most volatile (e.g., data in RAM, running processes, or live network connections) should be preserved first, as it may be lost or altered once the system is powered off or modified.

Topics

#digital forensics#order of volatility#evidence collection#incident response

Community Discussion

No community discussion yet for this question.

Full CISSP Practice