Don't turn it off: what to do in the first ten minutes

The instinct is to pull the plug. Sometimes that's right. Often it destroys the evidence that would tell you what happened and how far it went.

What's lost when a machine powers down

Everything in memory: running processes, network connections, decrypted data, the attacker's tools if they never touched disk. For a lot of modern intrusions, memory is where the story is. Once it's gone, you're reconstructing from fragments.

The first ten minutes

1. Don't touch the keyboard more than you must. Every action overwrites something.
2. Isolate at the network, not the power. Block the machine's traffic at the switch or the endpoint tool. It stays running; it stops talking.
3. Note the time, and who did what. A written log from minute one is worth more than people expect.
4. Capture memory if you have the tooling and the skill. If you don't, leave it running and get someone who does.
5. Preserve the logs before they rotate. Endpoint, identity, network, cloud control plane. Many of these have short retention by default.

When pulling the plug is right

When the machine is actively destroying data, encrypting a share, or attacking something else, and isolating the network doesn't stop it. Then the damage of continuing outweighs the evidence. That's a judgement call, and it should be made by someone, not by panic.

Why this matters beyond the technical

Evidence decides what you can say happened, to regulators, to customers, to insurers, and in court. "We don't know what they accessed" is an expensive sentence. The first ten minutes decide whether you'll have to say it.

If your team doesn't have a first-ten-minutes card they can reach for, I'll help you write one that fits how you actually work.

Explore: More on forensics and investigation · Work with me