## Live vs. Dead Forensics & Order of Volatility

When you approach a compromised machine, you have a choice: pull the plug or analyze it live?

### Order of Volatility (RFC 3227)
Data disappears at different rates when power is lost. You must capture the most volatile data *first*.

1.  **CPU Registers, Cache** (Nanoseconds). *Identical to impossible to capture usually.*
2.  **System Memory (RAM)** (Seconds). *Contains keys, passwords, unsaved documents, running processes.*
3.  **Network State** (Seconds). *Active connections to the hacker.*
4.  **Running Processes** (Seconds).
5.  **Disk (HDD/SSD)** (Years). *Files, Logs.*
6.  **Remote Logs / Backups** (Years).
7.  **Physical Configuration** (Forever).

**Golden Rule**: If you pull the plug, **RAM is gone forever**. If the disk was encrypted (BitLocker) and the key was in RAM, you have locked yourself out permanently.

### Dead Forensics (Post-Mortem)
*   System is powered off.
*   Hard drive is removed.
*   Imaged using a Write Blocker.
*   Analyzed in a lab.
*   *Pros*: Safe, no risk of altering data.
*   *Cons*: No RAM, no network state. Rootkits are inactive (harder to see).

### Live Forensics
*   System is running.
*   You insert a USB with trusted tools (DumpIt, FTK Imager Lite).
*   You dump RAM and run triage scripts.
*   *Pros*: Captures encryption keys, active connections.
*   *Cons*: **You alter the system**. Inserting a USB changes the registry. Running a tool consumes RAM. You must document *exactly* what you did to explain the changes in court.