Evidence Preservation First
What is it?
The governing rule of response: before any action that changes system state — rebooting, wiping, disabling, deleting — capture the evidence that action would destroy: volatile process/network state, relevant logs, the suspicious files themselves.
Why it matters
Response actions are destructive by nature. Evidence destroyed during containment cannot answer the questions eradication, root cause and any legal process will ask later.
Where you see it
The moments before a host is isolated or rebuilt — the last chance to capture what only exists while the machine is running.
What normal looks like
A short preservation step in every playbook: what to capture, where it is stored, who captured it and when — before the destructive action executes.
What suspicious looks like
An incident record that says 'machine was rebuilt' with no captured process list, no preserved logs and no file hashes — the investigation now ends where it should have started.
How analysts investigate
By ordering by volatility: capture what disappears first (memory, live connections, running processes), then what persists (disk, logs) — and recording the chain of who handled what.
Common beginner mistakes
- Rebooting a suspicious machine 'to be safe' — the reboot destroys the volatile evidence that would have proven what was running and where it was talking.
A well-meaning Marasi IT technician sees a strange process on the operations manager's laptop and reboots it. The process is gone, the connection is gone, and the only fact that survives is that something once looked strange.
| Evidence | Volatility | Capture before… |
|---|---|---|
| Running processes & network connections | Highest — gone at reboot | Any reboot or isolation that kills sessions |
| Suspicious files + hashes | Medium — malware may self-delete | Cleanup or wiping |
| Logs (endpoint, auth, network) | Lower — but rotation overwrites | Retention windows expire |
Quick check
You must isolate a beaconing laptop NOW. Which single capture matters most in the seconds before isolation cuts the network?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.