Question

A forensic investigator is responding to a confirmed compromise of a cloud-hosted Linux virtual machine that is still running. The investigator has provider cooperation and legal authority to collect all available artifacts. To preserve the most fragile evidence first, in what order should the investigator prioritize collection of the following data sources?

Accepted Answer

CPU registers and cache, then RAM contents and running process state, then disk-based logs, then archived snapshots in object storage

Answer

Archived snapshots in object storage, then disk-based logs, then RAM contents, then CPU registers and cache

Answer

Disk-based logs, then archived snapshots, then RAM contents, then CPU registers and cache

Answer

RAM contents, then CPU registers and cache, then archived snapshots, then disk-based logs