domains / families / security / collecting-volatile-evidence-from-compromised-host

collecting-volatile-evidence-from-compromised-host

separate

Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.

When to use

• Security incident confirmed and compromised host identified
• Before system isolation, shutdown, or remediation begins
• Memory-resident malware suspected (fileless attacks)
• Need to capture network connections, running processes, and system state
• Legal proceedings may require forensic evidence preservation
• Incident requires root cause analysis with volatile data

When not to use

• Isolating a compromised host
• Shutting down a compromised host
• Remediating a compromised host

Skill page

Source