What should not be altered?¶

During a cyber incident, people naturally want to fix the problem. That response can change or destroy evidence.

Evidential caution: that routine troubleshooting has no evidential effect.

What this means¶

Restarting a device may remove memory, terminate processes and close connections.

Deleting a malicious file may remove metadata and execution artefacts.

Resetting a password may end sessions or change authentication records.

Revoking tokens may remove evidence of ongoing access.

Uninstalling remote-access software may destroy configuration and logs.

Rebuilding a server may replace the environment in which the activity occurred.

Running cleaning tools may alter timestamps, quarantine files or delete data.

Before making changes, ask:

what evidence could this action remove;

can the current state be captured first;

who is authorised to make the change;

will the action alert the offender;

is specialist assistance required;

what operational harm would result from delay?

Also avoid informal examination. Opening suspicious files, clicking links, logging into affected accounts or browsing through a compromised system may create new events and contaminate the timeline.

Where urgent action is necessary, record who authorised it, when it occurred, what was done and why. Preserve screenshots, exports, logs or forensic captures where feasible beforehand.

================================================================================

Evidential limits¶

This does not mean systems must always be left exposed. Harm reduction and service recovery may require immediate action. The point is that the evidential consequence should be understood and documented.

A defensible investigation does not require perfect preservation at the expense of safety. It requires conscious decisions rather than undocumented alteration.