Overview
Description
Goal: Apply order of volatility and evidence integrity controls.
Scenario:
A hospital EHR server shows ransomware activity. The system is still running; PHI may be at risk.
Draft a 1–2 page plan that:
Lists which data you’d capture first → last (RAM, network tables, logs, disk, backups).
Explains why your order preserves probative evidence.
Notes tool categories (memory capture, EDR export, FTK Imager, dd, etc.) and integrity safeguards (write-blockers, SHA-256, immutable storage).
Identifies legal hooks (HIPAA, warrants, minimization).
States two tradeoffs (e.g., risk of altering system vs. losing encryption keys).