Evidence Collection Order

Evidence Collection Order for CyOps

1

Memory registers, caches

2

Routing table, ARP cache, process table, kernel statistics, RAM

3

Temporary file systems

4

Non-volatile media, fixed and removable

5

Remote logging and monitoring data

6

Physical interconnections and topologies

7

Archival media, tape or other backups