Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

What are the basics of digital forensics in an incident: order of volatility, evidence handling and what each artefact tells you?

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

mediumEssentialNewPreparation tags: CrowdStrike, Microsoft, GoogleUpdated Nov 2026

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A compromised Linux server must be investigated, and someone wants to reboot it immediately to stop the attacker.

  1. Why not reboot right away?
  2. What order do you collect evidence in?
  3. How do you keep evidence usable?
  4. What does each artefact answer?
  5. What changes in the cloud?
  6. How would you handle the server?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackA standard user account suddenly appears in the Domain Admins group. How do you investigate how it happened and what else changed?Next in this trackA finance employee's cloud mailbox was compromised and a supplier was asked to change bank details. How do you respond?Next in this trackWhat does NIST SP 800-61 Revision 3 change about how incident response is framed, and how would you apply it?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.