# First Responder Operations

When you are the first on the scene of a cyber incident, your actions in the first 15 minutes dictate the success or failure of the entire investigation. 

You must act with the assumption that the incident will eventually end up in a legal battle, meaning every step must be defensible in court.

## 1. Secure the Scene
Physical security comes before digital security. 
*   **Isolate the hardware:** Ensure no unauthorized personnel can walk up to the server rack or the suspect's laptop.
*   **Document physical connections:** Take photographs of the computer, showing exactly what cables are plugged into what ports before you touch anything. If someone later claims a rogue USB was plugged in, you have photographic proof it wasn't.

## 2. Triage the System State
Before pulling cables, you must determine what state the machine is in.
*   **Is it powered off?** Do NOT turn it on. Booting a computer modifies thousands of files, altering timestamps and potentially triggering malware designed to destroy data upon boot.
*   **Is it powered on?** Do NOT turn it off normally. Do NOT "pull the plug" right away. Leave it as is while you decide on your acquisition strategy (RAM first, then disk).
*   **Is there a screen saver or lock screen?** Photograph what is visible. Do not attempt to guess the password, as modern systems (like BitLocker or Apple's secure enclave) will permanently wipe the encryption keys after too many failed attempts.

## 3. Network Isolation
You need to stop the bleeding while preserving volatile data.
*   **The old way:** "Pull the network cable." 
*   **The modern way:** Use the switch, router, or EDR tool to logically isolate the machine. This allows you, the forensic analyst, to still remotely query the machine and pull RAM over the network, while preventing the machine from reaching the internet or the rest of the corporate network. 
*   **Warning:** If dealing with a mobile device, immediately put it in airplane mode or place it in a Faraday bag to prevent a remote wipe command from being received.

## 4. The "Live Response" Toolkit
If you must interact with the live machine (e.g., to capture RAM), you cannot use the tools already installed on the machine (like the built-in Task Manager or `ps` command). Why? Because a rootkit might have replaced the built-in `ps` command to hide its own processes. 

Instead, first responders bring a "Live Response Toolkit" on a clean, trusted USB drive containing statically compiled, trusted forensic binaries.