# Digital Forensics Evidence Handling
## Order of Volatility (RFC 3227)
1. CPU registers, cache → 2. Memory (RAM) → 3. Network state → 4. Running processes → 5. Disk → 6. Remote logging → 7. Archival media

## Chain of Custody Fields
Who collected, when, where, how, hash verification, storage location, access log

## Imaging Tools
- `dd` / `dcfldd` — raw disk imaging with hash verification
- FTK Imager — GUI forensic imaging
- `ewfacquire` — E01 format with compression
- Always write-block before imaging
