SANS Incident Handler's Handbook and PICERL Methodology P-g: P-g Ready tools in a jump bag: journal, contact list, bootable media, forensic laptop, tool kits, write-blocking duplicators

The team has software and hardware ready for use (anti-malware, laptops with packet capture, physical tools, checklists), kept in a jump bag that responders can grab. The paper's jump bag list: an incident handler's journal; a contact list of all team members; bootable USB or live media with current anti-malware and tools that can read and write the environment's file systems; a laptop with forensic and anti-malware software and internet access if needed; computer and network tool kits; hard drive duplicators with write blocking for forensically sound copies; and a bag to hold it all.