After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that…

Immediately after isolation, the investigator must capture volatile live data before it is lost, and analyzing currently running applications and services is the highest-priority volatile data source. Active malicious processes, injected DLLs, and suspicious network connections visible in running services reveal the malware's current behavior and attack surface, and this data disappears on reboot or shutdown.

Comparing workstation configuration against asset policy is a compliance gap analysis step and does not capture time-sensitive volatile forensic evidence that may disappear if the system is powered off.

Inspecting registry entries for recently executed files is a non-volatile disk forensics step that can be performed later without risk of data loss, making it lower priority than collecting volatile process data.

Reviewing audit logs for privilege escalation is also a non-volatile log analysis task that can be deferred, as logs are persisted to disk and are not at risk of being lost the way in-memory process data is.