What should I consider with a server?¶

A server may support many users, systems and services, so first-response action can have consequences far beyond the equipment in front of you.

Evidential caution: that a server can be handled like an ordinary desktop computer. Shutting it down, disconnecting a cable or logging in may interrupt services, destroy volatile evidence or affect many other systems.

What this means¶

Where an active cyber incident is suspected, containment and evidence preservation must be coordinated. Disconnecting the server may stop harm but may also remove visibility of the attacker.

Specialist digital-forensics, incident-response and system-administration support should normally be involved quickly.

What to check or do next¶

• Record the physical and operational context. Photograph the server, rack position, labels, displays, cables, storage units, network connections and power supplies.
• Note whether it is running, showing warnings, connected to backup power or part of a cluster, virtual environment or shared storage system.
• Do not begin navigating through administrative consoles unless authorised and competent to do so. Logging in can create records and alter the system state.
• Identify who owns and administers the server, what services it supports and whether business continuity, public safety or operational functions depend on it.
• If urgent action is unavoidable, use the least destructive effective measure and document the known risks, advice received and resulting impact.

Evidential limits¶

Do not restart or power off a server merely to preserve it. It may hold active sessions, memory-resident evidence, logs, virtual machines, databases or services that cannot be recreated easily.