medium10 pts · first answer countsdigital-forensicsincident-response
What evidence to collect first
Following the order of volatility, which evidence should you collect first from a live compromised server?
Discussion 0
Join free to post in the discussion.
Related questions
- Backups that survive ransomwareCybersecurity Analyst
- Why chain of custody mattersCybersecurity Analyst
- NIST incident response lifecycleCybersecurity Analyst
- Containing a hijacked Microsoft 365 accountCybersecurity Analyst
- What EDR host isolation doesCybersecurity Analyst
- File integrity alert on a web serverCybersecurity Analyst
- Artefacts of PsExec lateral movementCybersecurity Analyst
- First move on an encrypting hostCybersecurity Analyst