Commit 3ded9eba authored by Heiko Reese's avatar Heiko Reese

parent 1a0fa189
......@@ -78,3 +78,11 @@ mount -t tmpfs none /mnt
mount /dev/sdx1 /mnt
```
## Collecting evidence
Collect evidence by saving potentielly interesting parts of the system state. Start with the most volatile and work your way down:
1. network and connection state
1. process state
1. users
1. system configuration
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment