An intrusion has occurred in an internet facing system. The security administrator would like to
gather forensic evidence while the system is still in operation. Which of the following procedures
should the administrator perform FIRST on the system?
A.
Make a drive image
B.
Take hashes of system data
C.
Collect information in RAM
D.
Capture network traffic
C.
In accordance to the order of volatility.
0
0
gather forensic evidence while the system is still in operation
Network traffic is still in operation
answer D:
0
0
Isn’t it possible to create a drive image while the system is operational?
0
0