Lion Cipher Lab
Collect evidence in the right order (order of volatility)
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
When you respond to a possible compromise, some evidence is vanishing as you stand there. The contents of memory, the list of running processes, the live network connections — these exist only while the machine is on, and they change second by second; the moment you pull the plug, they're gone forever. Other evidence — files on disk, logs — is far more durable. The order of volatility is the incident-responder's rule for this reality: collect the most volatile evidence first, before it evaporates, and the durable evidence later. Getting this order right can be the difference between capturing…
What you'll learn
- what volatility means for digital evidence
- the standard collection order (most-volatile first)
- why powering off destroys evidence
- recording and hashing what you collect
- connecting the principle to a real triage
Steps in this lab
- What 'volatility' means for evidence
- The standard order, most-volatile first
- The most consequential decision: don't pull the plug (yet)
- Capture the volatile layer (read-only)
- Then the durable layer — and hash what you collect
- Balance speed against integrity
- Why the order is the whole game early on