Question

What are things to consider before pulling a plug for forensic Investigation. If an incident continues too long, what is the risk to the organization?

Answer 1

If the system seems to be active, and then pulling a plug will make us loss of valuable information. And we may not able revert it back to access the information. So, before pulling a plug for forensic Investigation, just obtain some information form the computer and then proceed to pull the plug. Information such as, what are the running applications, internet history, networks connected, may be recently open files, gather any external devices connected, most used applications data and trash contents, etc. The more the incident occur, the more the risk to the organization. The situation is being getting out of hands further. This makes the recovery afterwards also difficult.