Commit 3ded9eba authored by Heiko Reese's avatar Heiko Reese
Browse files

parent 1a0fa189
...@@ -78,3 +78,11 @@ mount -t tmpfs none /mnt ...@@ -78,3 +78,11 @@ mount -t tmpfs none /mnt
mount /dev/sdx1 /mnt mount /dev/sdx1 /mnt
``` ```
## Collecting evidence
Collect evidence by saving potentielly interesting parts of the system state. Start with the most volatile and work your way down:
1. network and connection state
1. process state
1. users
1. system configuration
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment