An IaaS virtual machine is confirmed compromised and is still running. The investigation may support legal action, and the responder must choose an evidence collection sequence. Which sequence best preserves the evidence?

Evidence collection follows the order of volatility: the most short-lived data is captured first. In a running VM, memory holds running processes, network connections, decrypted keys, injected code and command history that disappear at shutdown or reboot. The responder should therefore acquire a memory image first, using the provider's or hypervisor's capabilities or an approved in-guest tool, then take snapshots of the attached volumes, which are far less volatile, and only then consider shutting the VM down. Each artifact is hashed at acquisition and logged in the chain of custody so its integrity can be demonstrated later. A graceful shutdown destroys volatile memory and allows malware to run shutdown routines or clean up traces, so a consistent disk comes at the cost of the most volatile evidence. Snapshotting the volumes and then terminating the VM preserves disk data but still loses memory, and termination in many clouds also deletes ephemeral storage and instance metadata. Rebooting into a recovery image clears memory, and copying files to an analyst's laptop moves evidence onto an uncontrolled device with weaker integrity and custody guarantees. Exam caveat: containment, such as isolating the VM's network, can happen in parallel, but it must not destroy volatile state. Operational check: confirm the memory image and volume snapshots carry acquisition hashes, timestamps and collector identity, and that they are stored in a restricted, logged evidence repository.