forensics

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

Contain financial actions and reconcile provider state in parallel. Work through a synthetic exposure table, uncertain dispatch, cancellation limits and the evidence needed for a controlled restart.

Preserve relevant evidence within its authorization boundary. Protect collection, record gaps and transformations, and explain what a checksum does and does not establish.