SANS Incident Handler's Handbook and PICERL Methodology
Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology C-2: C-2 Take a forensic image of affected systems with recognised tools before wiping or reimaging, and store it securely

Before any system is wiped or reimaged, the team captures a forensic image of it with tools accepted in the forensics community, preserving its state as evidence for any prosecution and for understanding the compromise in lessons learned; the checklist also asks that forensic copies be kept in a secure location against damage or tampering.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls