A computer involved in a crime is infected with malware. The computer is on and connected to the company's network. The forensic investigator arrives at the scene.
Which action should be the investigator's first step?
Comprehensive and Detailed Explanation From Exact Extract:
Disconnecting the computer from the network by unplugging the Ethernet cable prevents further spread of malware and stops external communication that could lead to data exfiltration. This containment step is vital before further evidence collection.
Maintaining system power preserves volatile memory.
Network disconnection is recommended by incident response guidelines.
[Reference:NIST SP 800-61 recommends isolating affected systems from networks early in incident response., , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit