Question

A SOC analyst responds to a suspected intrusion on a Windows desktop that is still powered on and connected to the network. Management wants the investigation to preserve the maximum amount of forensic evidence. According to the order of volatility, which data should the analyst collect FIRST during the endpoint investigation?

Accepted Answer

The contents of RAM, including running processes and active network connections

Answer

A full bit-for-bit forensic image of the system hard drive

Answer

Archived Windows event logs stored on a backup server

Answer

The system registry hive files copied from the disk