To prepare for a third-party forensics investigation following an incident involving malware, the incident response team should:

Cleaning the malware before a forensic investigation could destroy critical evidence needed to understand the attack's scope, method, and origin.

While isolating infected systems is a critical containment step in an incident response, the primary preparation for *forensics* is evidence preservation, which often includes imaging the isolated systems.

Imaging the infected systems is a *method* of preserving evidence, but 'preserve the evidence' is the overarching objective that encompasses imaging and other actions.

Forensic investigations critically rely on the integrity and completeness of evidence. Before any other actions that might alter the state of infected systems, it is paramount to preserve all potential evidence, such as logs, memory dumps, and disk images, to ensure the third-party investigators have an accurate and untainted record of the incident for analysis.