An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following…

Memory (RAM) is volatile and contains critical forensic artifacts such as running processes, active network connections, encryption keys, and malware payloads that are lost the moment the system is powered off or altered. Capturing a memory dump first follows the order of volatility principle in digital forensics, ensuring the most transient evidence is preserved before any other remediation steps are taken. This supports both the investigation of how data was exfiltrated and identification of the unknown server.

Turning off the workstation immediately destroys all volatile data in RAM, permanently losing critical forensic evidence such as active connections and in-memory malware artifacts needed to investigate the incident.

Consulting the information security policy is a valid step but is not the first priority when live volatile evidence is at risk of being lost; policy consultation should occur as part of broader incident response planning, not ahead of evidence preservation.

Running a virus scan can alter file timestamps, overwrite artifacts, and modify the system state, which contaminates forensic evidence and should only occur after volatile data and disk images have been properly preserved.