From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Order of volatility

Order of volatility

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

Order of volatility

“

- In this lesson, we're going to discuss data acquisition and the order of volatility. Now, data acquisition is the method and tools used to create forensically sound copies of data from a source device, like a system's memory or its hard drives. When dealing with data acquisition, the first question you have to ask is, do I have the right to search or seize this legally? Now, this is an important question because in your organization, not all devices are owned by the company. If it's owned by the company, then you likely have the ability to collect evidence from it. But if you're using a bring your own device policy, then you may not. Bring your own device policies really complicate data acquisition because you may not legally be able to search or seize that device because the employee owns it, not the company. Even though your data may be the data on there, therefore, you need to gain the employee's permission before you can access and gather data from that device. Also, if you…

Contents