Question
An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation. Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?
- A. Hard disk
- B. Primary boot partition
- C. Malicious files
- D. Routing table Correct
- E. Static IP address
Explanation
Evidence should be collected in order of volatility, most volatile first. The routing table is volatile and changes or is lost when the server is isolated from the network or powered down, so it must be captured first. The hard disk, boot partition and files on disk persist and can be imaged later, and a static IP address is configuration that does not change on isolation.
