Preserving Evidence

In recovering a system, evidence is quicky destroyed or compromised.
Evidence which is destroy often can not be reliably recovered.
Preserving evidence for future analysis should take place first, whenever possible.
Recovery can proceed independently of forensic analysis once evidence has been preserved.

In recovering a system, evidence is quicky destroyed or compromised.