During a live incident, forensic analysts work alongside incident responders to understand the scope of the compromise, reconstruct attacker activity, support containment decisions, and preserve evidence for later analysis. The quality of that work depends heavily on the evidence collected during the earliest stages of the response.
For many years, full memory acquisition and disk imaging represented the gold standard of forensic evidence collection. However, the rapid growth of storage capacity and the increasing scale of enterprise environments have made comprehensive acquisition of every potentially affected system impractical during active incidents. At the same time, critical evidence may exist only in volatile locations such as memory, where running processes, active network connections, credentials, and malicious code can disappear or be overwritten within minutes.
These challenges led to the widespread adoption of forensic triage. Rather than immediately acquiring complete images from every system, investigators can rapidly collect high-value artifacts from memory and disk, identify compromised hosts, understand the nature of the incident, and prioritize systems requiring deeper acquisition. This approach is particularly valuable when multiple hosts are affected and investigative decisions must be made quickly.
Investigators must decide when a triage collection is sufficient, when volatile evidence requires immediate preservation, and when a full forensic acquisition is justified. The Order of Volatility offers an important foundation for these decisions, and standard operating procedures remain critical to ensuring consistency and evidentiary integrity. However, no single collection workflow is appropriate for every incident. Effective evidence collection requires understanding the strengths, limitations, and impact of each acquisition method, then adapting the collection strategy to the circumstances at hand.
Before discussing priorities, it is important to understand the three most common collection approaches available to responders.
Memory acquisition consists of capturing the contents of a system's RAM while the system is powered on.
Memory often contains information that cannot be recovered from disk, including:
Once a system is powered off or rebooted, this evidence is typically lost forever.
Memory acquisition is not a completely passive process. To capture RAM, the acquisition tool must be executed on the live system, which requires loading code into memory. As a result, a small portion of the existing memory state will inevitably be altered.
In addition, connecting acquisition media such as an external USB drive may generate operating system artifacts, including registry entries, device connection logs, and other system records. This forensic footprint is real and unavoidable.
However, the changes introduced by a well-designed acquisition process are typically limited, predictable, and can be thoroughly documented. Investigators should be able to explain:
This approach aligns with the ACPO Principle 2, which states that when access to original data is necessary, the person performing the action must be competent and capable of explaining the relevance and implications of their actions. Therefore, any modifications introduced during memory acquisition should be understood, documented, and justified as part of a sound forensic methodology.
The evidentiary value gained from acquiring memory generally far outweighs the minimal impact caused by the acquisition process. Failing to collect memory before a shutdown or reboot may result in the permanent loss of critical volatile evidence.
Disk imaging creates a bit-for-bit copy of an entire storage device.
Traditionally, this has been considered the gold standard for forensic preservation because investigators collect everything, including deleted files, unallocated space, and file-system metadata.
A modern workstation with several terabytes of storage can take hours to image, which is often incompatible with the realities of incident response.
Forensic triage is a rapid assessment and evidence collection approach used to identify and preserve the most relevant data before committing to a full forensic acquisition. It is commonly used during incident response, large-scale investigations, or situations where time, storage, or operational constraints make full imaging impractical.
Triage collection is a risk-based approach. The investigator prioritizes evidence that is known to provide high analytical value and can be acquired quickly. The findings from triage often help determine whether additional collection, such as memory acquisition or full disk imaging, is necessary.
Examples include:
Like memory acquisition, forensic triage is not a passive activity. Collection tools must execute on the live system and inevitably leave a forensic footprint. Although that footprint is generally limited and predictable, it should still be documented by the investigator.
It is also important to understand that triage provides a snapshot rather than a complete picture. Triage findings help investigators make informed decisions about containment, escalation, and additional evidence collection, but they should not automatically be treated as definitive proof that no additional evidence exists elsewhere on the system.
The Order of Volatility serves as the foundational framework for evidence collection, dictating that investigators must collect the most fragile evidence first. Because highly volatile data exists only while a system remains powered on, pulling the plug or delaying collection can permanently destroy critical artifacts.
As outlined in IETF RFC 3227, data should be gathered based on its lifespan, moving from most volatile to least volatile:
In theory, memory should always be collected first because it contains some of the most volatile evidence on a system. In practice, however, investigators are often tempted to begin with a rapid triage collection because triage tools can quickly gather large amounts of useful information from disk and system artifacts.
This creates an important trade-off. Running a triage collection requires executing code on the live system and inevitably leaves a forensic footprint. On heavily utilized systems, extensive triage activity may alter portions of memory that investigators would otherwise want to preserve for later analysis. As a result, responders must carefully consider whether the value of immediate triage outweighs the risk of delaying memory acquisition.
The decision is rarely absolute. Some incidents justify collecting memory first, while others may benefit from rapid triage to establish scope and prioritize affected systems.
One highly effective approach is a progressive, layered collection strategy. Instead of immediately committing to a broad triage collection, a full memory acquisition, or an all-or-nothing full disk image, investigators can adopt a progressive, layered collection strategy.
This workflow allows investigators to progress through four collection stages based on the urgency, scope, and requirements of the incident:
1. Ultra-Volatile Triage
Before executing intensive dumping tools, investigators use lightweight, minimally invasive commands, scripts or tools to catch live data that could be altered by heavier forensic software. This includes capturing active network connections, open ports, running processes, and currently logged-in users.
2. Volatile Memory Acquisition
A full RAM dump is captured using specialized tools. This preserves fileless malware payloads, active rootkits, volatile system configurations, and live encryption keys or plaintext passwords before they are wiped by a system shutdown or reboot.
3. Broad Triage Collection (e.g., KAPE)
Once the highly volatile memory is secured, investigators run rapid targeted triage tools like Kroll Artifact Parser and Extractor (KAPE). This stage targets high-value forensic artifacts which provide rapid visibility into system activity while avoiding the collection overhead associated with full disk imaging.
4. Full Disk Imaging
The final, traditional step. A bit-by-bit, forensically sound image of the storage media is taken after containment is established. This is reserved for deep analysis (carving for deleted files, inspecting unallocated space) and long-term legal evidentiary preservation.
This progressive flow provides a baseline, but this is exactly where forensic methodology becomes less of a rigid science and more of an art. The correct collection starting point always depends on the specific incident.
Experienced investigators do not blindly follow a checklist. They continuously balance key variables to adapt their collection strategy:
The purpose of understanding multiple collection methods is not to identify a single "best" approach. Different threats create different evidence preservation requirements. Some incidents demand immediate preservation of volatile memory, while others prioritize rapid scoping, broad visibility, or long-term evidentiary preservation. Effective investigators adapt their collection strategy to the characteristics of the threat rather than applying the same workflow to every case.
Each collection method serves a different purpose. The mistake is not choosing memory acquisition over triage, or triage over full imaging. The real mistake is assuming that any single method is universally applicable. Effective investigators understand the strengths and limitations of each approach and select the collection strategy that best preserves the evidence most relevant to the incident at hand.
No matter which collection approach is used, the process must be defensible.
Forensic analysts should be able to explain and justify every action performed during evidence acquisition. This includes documenting:
Admissibility is generally determined by the reliability and defensibility of the collection methodology rather than the volume of data collected. A properly documented memory acquisition or targeted triage collection may provide greater investigative and evidentiary value than a full disk image acquired after critical evidence has already been lost.
Digital forensics is ultimately an exercise in prioritization. During a live incident, collection decisions must be made under time pressure, often with incomplete information and limited resources. Understanding the strengths and limitations of memory acquisition, forensic triage, and full disk imaging allows investigators to make informed decisions that preserve the evidence most critical to the investigation.
In a future article, we will examine how modern DFIR teams are integrating forensic triage, automation, and AI-assisted analysis to accelerate investigations while maintaining forensic rigor and analyst oversight.
