Question

An IS auditor is observing the incident response team's handling of a compromised server that is still powered on and connected to the network. The team wants to preserve evidence for a potential legal case. Which action should be performed FIRST to maximize the evidentiary value of the collected data?

Accepted Answer

Capture the contents of memory and running network connections before shutting down the system

Answer

Power off the server immediately to prevent further attacker activity

Answer

Create a bit-for-bit forensic image of the hard disk after a clean shutdown

Answer

Disconnect the network cable and reboot the server into a forensic environment