I've sat in on loads of interviews in the last few months with #DFIR/#SOC candidates who don't understand the order of volatility. So I wrote a quick LinkedIn post about it: https://www.linkedin.com/posts/taswake_linux-dfir-for577-activity-7124461789123112961-lR5A #forensics #incidentresponse #CyberSecurity