공장장과 함께하는 디지털 포렌식 이야기

영문

 

rfc3227.pdf

 

 

국문번역본

 

rfc_3227.pdf

 

 

2.1 Order of Volatility

   When collecting evidence you should proceed from the volatile to the
   less volatile.  Here is an example order of volatility for a typical
   system.

      -  registers, cache

      -  routing table, arp cache, process table, kernel statistics,
         memory

      -  temporary file systems

      -  disk

      -  remote logging and monitoring data that is relevant to the
         system in question

      -  physical configuration, network topology

      -  archival media