Save the Evidence

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 4 of 20.

Stopping a program changes what you can see. Before you clean up a computer, save the evidence that explains what was happening.

In this lab, preserve saves a snapshot of the computer’s files, processes, startup entries, connections and logs. It keeps the running state as it was at that moment:

seclab preserve practice-laptop

You should see:

Preserved evidence for practice-laptop. SHA-256: 6df009810bd29a3bb0c95acdd17e343245ff236e94ca684396b71b562a3476b4

The long SHA-256 value identifies this saved snapshot. Read the saved evidence to check that the copy exists:

seclab inspect evidence

Look for these lines:

practice-laptop:
  SHA-256: 6df009810bd29a3bb0c95acdd17e343245ff236e94ca684396b71b562a3476b4

Preserving evidence does not stop an attack. It saves a record so you can act without losing the original picture. Reading records does not advance the lab clock; making a change does. Later tickets may need you to save evidence and then act promptly.

Challenge

Easy

Ticket from Sam, IT lead

Save the evidence from design-laptop while the helper is still running. Sam needs the original process and connection records before approving cleanup. Check that the evidence exists, and keep the approved backup and Lumen’s checkout service working.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File FingerprintsSave the EvidenceAnother Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a Timeline Did Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report