Question

During an active intrusion on a Linux production server, the IR team must collect evidence before decommissioning the host. Business requires the server be reimaged within 30 minutes to restore service. The lead analyst wants to maximize forensic value while respecting the time constraint. Which data should be collected FIRST to preserve the most fragile evidence?

Accepted Answer

CPU cache, registers, and the contents of RAM including network connection state

Answer

Bit-for-bit forensic image of the system's SATA disk

Answer

Archived syslog files copied to an external evidence drive

Answer

Configuration backups and installed package manifests from the host