Digital › Module 5 › Lesson 3
Memory Order
Memory order means volatile-first collection — capture RAM and live state before power-off when policy allows on authorized $DFIR_LAB scenarios.
Visual · t26_memory_order
Volatile-first literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Reboot destroys RAM artifacts — order-of-volatility puts memory near the front when safe and authorized.
Classic order: network/live response → memory dump → disk imaging → log collection — adapted to safety, encryption, and legal constraints. Memory-first prevents losing processes, keys, and connections that never touch disk. Disk-first without memory is incomplete for many incident classes — but rushing unsafe live capture is also wrong. Cyberlium writes memory-order checklist for YOUR $DFIR_LAB tabletop scenarios — when to pause for counsel, when VM snapshot RAM is enough — never live-capture stranger devices. Next: Memory Lab.
1. Volatile-first rationale (named)
RAM holds ephemeral malware stages, encryption keys, logged-on sessions, and network tables. Power-off or reboot clears them. Disk may still have persistence — but memory answers 'what ran right now?'
On $DFIR_LAB tabletop, sequence five steps for a practice VM incident — label which are volatile vs persistent.
Command guide
Try these commands — Volatile-first rationale (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Process analysis — https://www.volatilityfoundation.org/ (pslist/pstree literacy — on authorized dumps) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (running processes = volatile) CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
python3 - <<'PY'
plugins = ['windows.pslist', 'windows.pstree', 'linux.pslist', 'linux.bash']
print('Volatility plugin literacy (authorized dumps only):')
for p in plugins: print(f' vol -f dump.raw {p}')
print('Lab substitute: ps aux on YOUR machine — not a memory dump')
PYCommand — copy this
grep volatile "$LAB_DFIR/notes/evidence-classification.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Process analysis (https://www.volatilityfoundation.org/); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. When to delay memory capture
Safety: active attacker on critical life-safety OT. Legal: authority does not cover live acquisition. Technical: full-disk encryption with keys only in TPM and powered off — scenario-dependent.
Document decision and approver — defenders defend process, not just findings.
3. Lab vs live boundary
Forbidden: live RAM capture on unauthorized laptop because 'volatile-first says so.' Allowed: order checklist — volatile steps, persistent steps, pause conditions, $DFIR_LAB VM snapshot option.
Ship: memory-order checklist with volatile-first note. Next: Memory Lab.
4. What you ship: memory-order checklist for $DFIR_LAB
Ordered steps, volatile vs persistent tags, pause conditions. $DFIR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Memory order checklist. $DFIR_LAB named. File t26-m05-l03-memory-order.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Reboot lab VM before noting volatile loss. Capture stranger RAM without authority.
Right
Write memory-order checklist for YOUR $DFIR_LAB scenario. Next: Memory Lab.
Mission: sequence volatile-first on YOUR tabletop
1) List five collection steps in order. 2) Tag volatile vs persistent each. 3) Name one pause condition. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
VM snapshot RAM is a gentle volatile-first intro before hardware live capture.
Knowledge Check
APPLY: Memory order (volatile first) means:
Multiple choice
Knowledge Check
APPLY: True or False: Rebooting before memory capture can destroy RAM artifacts.
True or False
Knowledge Check
APPLY: Live memory capture on unauthorized devices is:
Multiple choice