Preserving Volatile Evidence in the First Hours of Incident Response Without Slowing Down Recovery

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

Resolving the Tension Between IT Business Continuity and Legal Evidence Preservation

When ransomware encrypts production servers or an unauthorized intruder is detected inside an enterprise network, internal IT teams face immense pressure to wipe machines, restore backups and bring operations back online immediately. Meanwhile, the legal team, cyber insurers and regulators need to know how the attacker entered, how long they dwelled in the environment and whether regulated personal or financial data was exfiltrated. Capturing volatile evidence before hosts are wiped or powered down is what gives the organization a factual basis for its notification decision, in place of a worst case, enterprise wide assumption.

Capturing Volatile Memory and Rolling Telemetry in Parallel With Containment

Global Digital Forensics works alongside corporate IT security teams and under the direction of retained breach counsel to execute rapid triage preservation that runs alongside operational recovery. Live RAM on a compromised server holds active attacker network connections, running malware processes and encryption keys, so our incident response specialists isolate the affected network segments at the switch or endpoint detection layer first and keep the server powered. We then deploy rapid live memory capture and forensic triage collectors across critical domain controllers and compromised endpoints in minutes, allowing your IT staff to proceed confidently with eradication and restoration while our examiners analyze the preserved evidence in our lab.

What the Preserved Record Holds and How It Is Read

A memory image taken from a live domain controller or file server is the closest thing an examiner gets to a photograph of the intrusion in progress. It holds the running process list, the network connections the attacker had open, injected code that never touched disk, cached credentials and in many ransomware cases the encryption keys or configuration the malware loaded. Paired with the Windows event logs, the Sysmon or EDR telemetry and the NTFS Master File Table and USN journal, the examiner reads that image for which account was used, which tool was staged where, and in what order hosts were touched. Those are the facts needed to answer the two questions every regulator and insurer asks: how did they get in, and what did they reach.

We report the reach of each record so every finding carries its true weight. NetFlow and firewall session logs establish that a volume of data left a host for a given destination, and the examiner looks to full packet capture, staged archives and the receiving side for what that data contained. Microsoft Purview audit events record mailbox access where the tenant's licensing and audit configuration captured it, so the examiner confirms that configuration before reading the events and treats a mailbox that was never audited as an open question rather than a quiet one. Where EDR retention rolled over before the alert, or an MSP already rebuilt the beachhead server, we document the period, turn to the other sources that cover it and explain the effect on the notification analysis. Mapping coverage early lets the response team plan the data breach analysis around the evidence in hand.

The record reads best when three questions are asked of every finding: what artifact supports it, what alternative explanation the examiner considered and what the finding would look like if the attacker had done more. A sign in from unfamiliar infrastructure becomes an intrusion finding when it is tied to a session that did something the account owner did not do. A staged archive becomes an exfiltration finding when the examiner finds evidence that it left. We write each finding with its artifact, its alternatives and its weight so that counsel can decide which facts belong in a notice, which belong in a memo to counsel and which call for further corroboration. Reports built that way are written for review by an insurer's panel examiner or a regulator's staff, and they let the organization base its notification decision on the record.

The Standards the Preservation Will Be Held To

Once litigation or a regulatory inquiry is reasonably anticipated, the duty to preserve attaches, and Federal Rule of Civil Procedure 37(e) sets the consequence for electronically stored information lost because a party failed to take reasonable steps to preserve it. Imaging servers before recovery, extending SIEM retention while scope is settled and pausing scheduled EDR purges are the reasonable steps a company points to if a spoliation question arises months later. We document what was preserved, by whom, with what tool and what hash values, so counsel can show the court that the steps taken were reasonable under the pressure of the moment.

GDF coordinates evidence preservation with the team containing the incident. We set the collection priorities, document the sources and build a chronology that management, the legal team and security staff can use to direct the response. Speak with an examiner to scope the work and agree on immediate next steps.

How the Engagement Runs From the First Call to the Lab

The engagement opens with a scoping call that includes the legal team, because the retention letter and the direction of counsel shape how the work product is handled from that point forward. We ask what has already been done to the environment, which hosts are encrypted or suspected, what logging exists and where it lives, and which operations must keep running. From those answers we set a preservation order of priority: volatile memory and live network state on the hosts most likely to hold attacker tooling, then rolling logs that will overwrite themselves, then full disk images, then cloud tenant exports. Setting that order on the first call points the response team's first hours at the most perishable evidence.

Collection then runs in parallel with containment rather than in front of it. Examiners capture memory with a hashed tool run, pull triage packages covering registry hives, event logs, scheduled tasks, prefetch and shell history, and image disks through hardware write blockers or through the hypervisor's snapshot export when the host is virtual. Cloud sign in logs, unified audit logs and identity provider exports are collected with their native timestamps intact. Each item receives a chain of custody record at the moment of acquisition. Your IT staff can then rebuild the host with confidence, because the evidentiary copy already exists and recovery and preservation run side by side.

Analysis and reporting follow the collection, and the structure of the report is agreed with the attorneys before the first page is written. The technical appendix carries the artifacts, hash values and timeline that another examiner could check. The narrative explains, in terms a board or a regulator can follow, what the record shows about initial access, lateral movement, privilege escalation and data staging, with the reach of each source stated. When the matter proceeds to a declaration, a deposition or trial testimony, the same examiner who did the work speaks to it, and our expert witness practice has carried that work into federal and state courts. The report is built from the first hour for that scrutiny.

First Day Decisions That Protect the Most Evidence

The most valuable decision runs against instinct: keep a host that is visibly encrypting files powered on and isolate it from the network, so memory keeps whatever keys, process tree and live connections it holds for the examiner. The second is to capture before any estate wide antivirus sweep, because the scan changes file access timestamps and quarantines the binaries an examiner needs to analyze. The third is to image a compromised volume before a backup is restored over it, which keeps the record of what the attacker did there, and the fourth is to export the sign in logs before resetting passwords across the directory, which keeps the trail to the entry point account in place. Our note on digital evidence preservation mistakes walks through the rest.

These decisions come down to who acts and in what order, and recovery keeps moving throughout. The security lead isolates affected systems at the switch or through the EDR console and leaves them running. The infrastructure lead extends log retention on the firewall, VPN concentrator, identity provider and SIEM so the records stay within retention through the response, and pauses any automated reimaging job. General counsel retains breach counsel and routes the technical engagement through that counsel, and the insurance notice is made within the policy's terms. Communications about the incident move to an out of band channel separate from the affected environment. Organizations with an Incident Response SLA in place have their contacts on file before the alert, and those that want them assigned now can start with our forensic readiness planning work.

Immediate Steps Before Reimaging a Compromised Server

Isolate affected hosts from the network while keeping them powered, freeze rolling firewall, VPN and cloud authentication logs immediately, and call the Global Digital Forensics 24/7 emergency response line at (800) 868-8189 to deploy our forensic triage specialists. If the clock is not yet running, our Incident Response SLA commits response times and hourly rates and keeps your environment details on file before the next alert.

Order of Volatility and the Clock on Each Source

The guide explains why preservation runs in parallel with containment and in order of volatility. This table lists the sources from most perishable to most durable, what each holds and the published or configured clock that sets the deadline. Read it as the preservation order an examiner sets on the first call, so recovery and preservation work through the same hosts in order. The regulatory clocks in the last rows run from discovery or determination, so they start ahead of the analysis.

How to Begin and What Happens on the First Call

For the first call, have ready the time of discovery, a rough list of the hosts and accounts involved, who has already touched them and what was done, and the names of your logging platforms and their retention settings. On the first conversation our examiner asks whether the attacker still appears to be active, which systems the business most needs to keep running, whether counsel and the insurer have been notified and what regulatory clocks may apply. Afterwards you receive a written scope that sets the preservation order, a timing plan for collection alongside recovery and a proposal for the analysis and reporting the matter needs. The initial consultation is free and the hotline at (800) 868-8189 is answered 24/7 by people who can start the preservation plan on that call.

Technical References and Further Reading

Primary sources and provider documentation behind this guide: SP 800-61 Revision 3.

Authorities cited in this guide: Federal Rule of Civil Procedure 37(e). Sets the consequences for electronically stored information lost through a failure to take reasonable steps to preserve it, as published by the Legal Information Institute in the current rules text. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. Describes the order of volatility and the collection, examination, analysis and reporting phases that this guide follows, in the final published version. NIST SP 800-61 Revision 3. Frames incident response as part of cybersecurity risk management under the Cybersecurity Framework 2.0, in the final Revision 3 text. DFARS 252.204-7012. Establishes the 72 hour rapid reporting requirement and the 90 day image preservation duty for defense contractors, in the current acquisition.gov clause text.