evidence must be collected following the order of volatility

order the evidence to be collected.

a$.$ Data on hard disk

b$.$ routing table, ARP cache, process table, kernel statistics

c$.$ CPU, Cache and register content

d$.$ Temporary file system $/$ swap space

e$.$ memory