During which incident response phase is evidence obtained and preserved?

Evidence is primarily obtained and preserved during the Containment phase of the incident response lifecycle. The goal of this phase is to stop the incident from causing further damage. A critical activity is to create forensic images of affected systems (e.g., memory dumps, disk images) before taking any eradication actions. This preserves the state of the system and any volatile evidence that would be lost if the system were shut down or cleaned, ensuring it is available for later analysis.

A. The lessons learned phase is a post-incident review to improve future responses; evidence collection should be long completed by this stage.
C. Eradication involves removing the threat (e.g., malware). This action alters the system and can destroy evidence, which is why preservation must occur beforehand.
D. Recovery is the process of restoring systems to normal operation from clean backups, which would overwrite any remaining evidence on the affected systems.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. Section 3.3.2, "Containment," states: "At this point, it is also important to preserve evidence, which may be needed for legal action."

2. MIT Information Systems & Technology. (n.d.). Incident Response Plan. Section "Containment Strategy" outlines the need to "Preserve evidence from the compromised system(s) for prosecution." This is a standard university-level implementation of the NIST framework.

3. SANS Institute. (2020). The SANS Incident Handler's Handbook. The handbook details the six steps of incident handling, emphasizing that forensic data collection is a key part of the Containment, Eradication, and Recovery phase, with initial preservation being critical in Containment.