Joe a computer forensic technician responds to an active compromise of a database server. Joe first collects information in memory, then collects network traffic and finally conducts an image of the…

Order of volatility is a forensic principle dictating that evidence should be collected starting with the most transient data first. RAM (in-memory data) is lost when power is removed, network traffic dissipates in seconds, and hard drive images are stable and can be captured last. Joe followed this exact sequence: memory → network traffic → disk image.

Chain of custody refers to the documented chronological record tracking who handled evidence and when, not the sequence in which evidence types are collected.

Recovery procedure refers to the steps taken to restore a system to normal operation after an incident, not the prioritized order in which forensic evidence is gathered.

Incident isolation refers to containing or segmenting a compromised system to prevent further spread of an attack, not the methodology for collecting forensic evidence.