A compromised production server is still running, and investigators need to preserve as much useful evidence as possible. Which approach should they follow?
Select an answer to reveal the explanation.
Short Explanation
Evidence in memory is like footprints in the snow on a sunny day. Wait too long and they're gone. You grab the stuff that disappears fastest first, then the things that stick around.
Full Explanation
Evidence collection follows the order of volatility: data that is lost quickly is collected before data that persists. Memory contents, running processes, active network connections and logged-on sessions disappear when a system is powered off or changes state, and they often contain the most revealing evidence, such as injected code, decryption keys and command-and-control connections. Disk contents persist and can be imaged afterwards. Powering off the server immediately destroys all volatile evidence and may trigger destructive routines, so it should not be the first step when the goal is preservation. Imaging the disk first may take hours, during which memory changes and processes end, so the most volatile evidence is degraded while the most stable evidence is collected. Running antivirus to remove malware alters the system and can delete the artefacts investigators need, making attribution and scope determination harder. Exam caveat: the security manager does not perform the collection but must ensure procedures and trained staff follow the order of volatility and that containment decisions consider evidence needs. Operational check: confirm collection procedures list volatile sources first, that hashes are recorded for each acquisition and that actions are logged with times and responsible personnel.