Question

A forensic analyst responding to a live compromised Linux server must collect evidence following NIST SP 800-86 guidance. The system is still powered on and connected to the network. According to the order of volatility, which data source should the analyst prioritize collecting FIRST?

Accepted Answer

The contents of the system's RAM and the running process/network connection state

Answer

Log files stored on the local hard disk

Answer

Data archived to the organization's offsite backup tapes

Answer

Configuration files stored in the /etc directory on disk