Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Incident Response Foundations
TheoryBeginner14 minIncident Triage

Evidence Preservation First

What is it?

The governing rule of response: before any action that changes system state — rebooting, wiping, disabling, deleting — capture the evidence that action would destroy: volatile process/network state, relevant logs, the suspicious files themselves.

Why it matters

Response actions are destructive by nature. Evidence destroyed during containment cannot answer the questions eradication, root cause and any legal process will ask later.

Where you see it

The moments before a host is isolated or rebuilt — the last chance to capture what only exists while the machine is running.

What normal looks like

A short preservation step in every playbook: what to capture, where it is stored, who captured it and when — before the destructive action executes.

What suspicious looks like

An incident record that says 'machine was rebuilt' with no captured process list, no preserved logs and no file hashes — the investigation now ends where it should have started.

How analysts investigate

By ordering by volatility: capture what disappears first (memory, live connections, running processes), then what persists (disk, logs) — and recording the chain of who handled what.

Common beginner mistakes

  • Rebooting a suspicious machine 'to be safe' — the reboot destroys the volatile evidence that would have proven what was running and where it was talking.

A well-meaning Marasi IT technician sees a strange process on the operations manager's laptop and reboots it. The process is gone, the connection is gone, and the only fact that survives is that something once looked strange.

EvidenceVolatilityCapture before…
Running processes & network connectionsHighest — gone at rebootAny reboot or isolation that kills sessions
Suspicious files + hashesMedium — malware may self-deleteCleanup or wiping
Logs (endpoint, auth, network)Lower — but rotation overwritesRetention windows expire

Quick check

You must isolate a beaconing laptop NOW. Which single capture matters most in the seconds before isolation cuts the network?

A quick self-check — it doesn't affect your XP or progress.

Sign in to save your progress on the server.