Which of the following should be done FIRST following an incident that has caused internal servers to be inaccessible, disrupting normal business operations?

Question

Options

• AMake a bit-level copy of the affected servers and calculate the hash value of the copy.
• BCopy all key directories and files on the affected servers and generate the hash value of the copy.
• CUnplug all power cables immediately to prevent further actions of the attacker on the servers.
• DDocument the servers' dates, times, and locations, as well as the individual who last used them.

• A
  70% (19)
• B
  4% (1)
• C
  7% (2)
• D
  19% (5)

Explanation

A bit-level (forensic) image captures the entire disk exactly as it is - including deleted files, unallocated space, and metadata - while the hash value cryptographically proves the copy is unaltered, making it admissible evidence and preserving the full picture of the attack before anything changes.

B is wrong because copying only selected directories and files is a partial, cherry-picked snapshot that misses deleted files, unallocated space, and hidden artifacts - critical forensic data that a full bit-level image captures.

C is wrong because yanking power cables destroys volatile memory (RAM), which may hold active processes, encryption keys, and live network connections - valuable evidence that disappears the moment power is cut.

D is wrong not because documentation is unimportant, but because it is not the first priority; documenting metadata about the servers is part of chain-of-custody recordkeeping that accompanies the imaging process, not a prerequisite to it.

Memory tip: Think of the servers as a crime scene - your first instinct should be to photograph everything exactly as it is (the forensic image + hash) before anyone touches a single thing, because you can never recreate the original state once it changes.

No community discussion yet for this question.