Containment Without Destroying Evidence
What is it?
Containment is stopping the intrusion from spreading or causing more damage while keeping the investigation intact. Its central tension is that the fastest way to stop an attacker — powering off the host — is also the fastest way to destroy evidence. The Tier-2 skill is choosing actions that do both: network-isolate rather than power off, capture volatile evidence in order of volatility (memory first), and avoid tipping off the attacker before you are ready.
Why it matters
Get containment wrong and everything downstream suffers. Power off and you lose the memory that holds the attacker's live tooling, credentials and network connections — often the only place they exist. Move too loudly and the attacker burns their access, deploys ransomware, or goes dormant elsewhere. Containment is where speed and forensic care are in direct tension, and balancing them is a defining Tier-2 judgment.
Where you see it
Containment actions are network isolation (host quarantine via EDR or a switch/VLAN change), disabling a compromised account, blocking a C2 destination, and capturing a memory image before touching disk. Short-term containment stops the immediate bleed; long-term containment (rebuilt segments, reset credentials) holds while eradication proceeds.
What normal looks like
Good containment isolates the host from the network while leaving it powered on, captures memory before disk, disables compromised credentials, and blocks C2 — quietly and quickly, coordinated so the attacker is cut off across all affected assets at once where possible. Evidence is preserved at every step because the investigation still needs it.
What suspicious looks like
Poor containment powers off or re-images the host (destroying volatile evidence), captures disk before memory (losing the most volatile data first), tips the attacker off with a noisy, uncoordinated action (so they escalate or vanish), or contains one host while nineteen others keep beaconing because the response was not coordinated to the scope.
How analysts investigate
Choose containment that stops the spread and preserves evidence: isolate from the network without powering off, capture volatile data in order of volatility (memory, then network state, then disk), and disable compromised accounts and C2. Coordinate so all known affected assets are contained together, and stay as quiet as possible until you are ready to move decisively across the whole scope.
Common beginner mistakes
- Powering off or re-imaging a live host, destroying the volatile memory evidence.
- Capturing disk before memory, losing the most volatile data first.
- A noisy, uncoordinated containment that tips off the attacker before the whole scope is ready.
What you will be able to do
- Choose containment that stops spread and preserves evidence.
- Capture volatile evidence in the correct order of volatility.
- Contain across the full scope without tipping off the attacker.
Containment is the first place your instinct will betray you. The fastest way to stop an attacker is to pull the power — and it is also the single most destructive thing you can do to the evidence, because a running system's memory holds the attacker's live tooling, decrypted payloads, credentials and connections, none of which survive a shutdown. The whole skill is stopping the attacker while keeping that evidence alive.
| Order of volatility | Evidence | Why first / last |
|---|---|---|
| 1 (most volatile) | Memory (RAM): live processes, keys, connections | Gone the instant power is lost |
| 2 | Network state, running connections | Changes second by second |
| 3 (least volatile) | Disk: files, logs, artefacts | Persists across reboot — capture last |
Worked example — which containment action?
A) power off the host immediately
B) network-isolate the host (keep it running), then capture memory, then disk
C) leave it fully online and just watchThe answer: B. Option A stops the attacker but destroys the memory — the live processes, injected code, decrypted payload and credentials vanish the instant it powers off, and you may never reconstruct what happened. Option C preserves evidence but does not contain — the attacker keeps spreading and exfiltrating while you watch. Option B does both: network isolation cuts the attacker's control and lateral movement immediately, while the host stays powered on so you can capture memory first, then network state, then disk, in order of volatility. Contain and preserve are not a trade-off when you isolate instead of power off.
Recap
- Isolate from the network; never power off a live host — memory is the most volatile evidence.
- Capture in order of volatility: memory, then network state, then disk.
- Coordinate containment to the full scope; a noisy partial move tips off the attacker.
Sign in to save your progress on the server.