Forensics preservation without tipping actors

Overview

Stealth preservation matters when APT may monitor email or RMM. Balance legal need for evidence vs operational secrecy.

Principles

• Use out-of-band comms (phone tree, clean devices) for IR coordination—not the potentially monitored Teams tenant at first.
• Memory capture before planned shutdown if preserving volatile artifacts; powered-off disk still valuable but loses RAM secrets.

Collection

• Agent-less or offline imaging preferred when EDR might alert intruders; coordinate with MSS on alert silencing windows.
• Cloud: export activity logs to immutable storage account quickly; enable legal hold on mailboxes in scope if counsel approves.

Mistakes

Announcing “we are investigating” company-wide; running noisy vulnerability scans on attacker beachhead before triage.

Chain

Custody tags before hand drives between sites; hash acquired images immediately.

Guidance

Follow retainer forensic partner instructions—they may prefer write-blocked clones over live triage on patient zero.