Question

A responder arrives at a compromised but still-running Linux server that is actively communicating with an external IP. Management wants a forensically sound image before the system is taken offline. Which evidence should the responder collect FIRST to preserve the most fragile data?

Accepted Answer

The contents of RAM, running processes, and active network connections

Answer

A bit-for-bit image of the primary hard disk

Answer

Archived syslog files stored on a remote log server

Answer

A backup tape containing last night's full system snapshot