At an agency, a laptop is still powered on and the suspect process is resident in memory. What should be collected before that laptop is shut down?
Select an answer to reveal the explanation.
Short Explanation
Copy the whiteboard before someone erases it. You collect memory and the live process list while the agency laptop is still powered on. The trap is waiting for a disk image after shutdown, or walking off with a floor plan or next month's patch list.
Full Explanation
Volatile state lives in memory and disappears when power is removed. The suspect process is running now, so the collection that has to happen before shutdown is Volatile state, including a memory image and the list of processes still running. NIST SP 800-86 puts that live collection ahead of powering the machine off, because the contents of RAM are gone after shutdown. A disk image can still be taken later. It is the wrong collection to rely on alone if it waits until the machine is already off. Only a disk image collected after the laptop has already been powered completely off loses the process that exists only in memory. The printed floor plan of the office suite where the laptop was sitting documents a room and not the contents of RAM. Next month's patch calendar for software that is not executing on this laptop is a future maintenance list, not evidence of the running process. Exam caveat: hash the copies you make and preserve the original, and do not treat a later disk image as a substitute for memory you never captured. Operational check: capture memory and the live process list while the laptop is still powered, record the hash of each copy, and only then move on to a disk image.