How would you approach collecting data from a live host while minimizing further damage or data loss?

• A. Take a full disk image first, ignore volatility
• B. Shut down the system before collecting any data
• C. Only collect non-volatile data to avoid alerting users
• D. Apply live-response best practices: document scope, collect volatile data first, use approved tools, minimize changes, and secure evidence with proper chain-of-custody

Answer: (D)

The key idea is to preserve volatile evidence on a live host while minimizing impact on the system, using a controlled, documented live-response process. Volatile data, such as memory contents, running processes, open network connections, and encryption keys resident in RAM, can vanish in moments if the system is shut down or rebooted. Capturing this data first ensures you don’t lose critical indicators of compromise or attacker activity. Using approved tools that are validated for forensics helps guarantee data integrity and reproducibility, and avoiding unnecessary changes prevents altering the system state in ways that could hide or contaminate evidence.

Documenting the scope keeps the collection focused on what’s needed for investigation, while minimizing changes reduces the chance of interfering with the system’s operation or alerting users and defenders. Securing evidence with proper chain-of-custody ensures the data remains admissible and traceable through the investigation. After volatile data is captured, you can proceed with non-volatile data collection if needed, but only in a controlled manner.

The other options fall short because they either miss essential volatile data, risk immediate loss of evidence, or introduce changes that could complicate or contaminate the investigation.