Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident...