How do you contain a system without destroying evidence?

To contain a system without destroying evidence, cut its network connections without switching it off, ideally from the EDR console. The machine stays powered on, its memory is preserved and analysts can keep examining it remotely. Evidence is then collected from the most volatile to the least volatile, nothing is deleted, and every action is logged.

Containing without destroying is a pivotal moment in incident response. For the bigger picture, see our guide How does incident response work?.

Why you should not switch it off

The memory of a compromised machine holds things that exist nowhere else: running malicious processes, live network connections, sometimes encryption keys, executed commands, and tools that only ever live in memory. Shutting down wipes them. That is why cybermalveillance.gouv.fr advises against switching affected machines off, and against powering on machines that were already off.

Containment methods, from cleanest to bluntest

Method	Advantage	Limitation
EDR network isolation	Remote, immediate, machine still reachable from the console	Needs a working EDR in place
Quarantine on the switch or firewall	No agent needed on the machine	Requires network access and good mapping
Unplug the cable, turn off Wi-Fi	Simple, anyone can do it	Analysts lose remote access
Cut the site’s internet access	Stops contact with the attacker	Also stops legitimate business
Shutdown	Stops everything	Destroys in-memory evidence: avoid

In Microsoft Defender for Endpoint, for example, the “Isolate device” action disconnects the machine from the network while keeping its connection to the Defender service, and “Collect investigation package” gathers forensic data. See Do you need an EDR for a managed SOC?.

Contain accounts and cloud services too

Attacks are not limited to machines. For identities and cloud services:

• Disable compromised accounts rather than deleting them, and reset their passwords.
• Revoke active sessions and tokens, particularly in Microsoft 365 or Google Workspace.
• Keep suspicious mailboxes and mail rules: document them before removing them.
• Export audit logs before they reach the end of their retention period.

See Microsoft 365 attacks MSPs do not see coming.

Collect in the right order

RFC 3227, the reference on evidence collection, recommends working from the most volatile data to the least. In practice:

1. Memory: processes, connections, memory contents.
2. System state: routing table, ARP cache, open sessions.
3. Temporary files.
4. Disk: a full image, or at least the key artefacts.
5. Remote logs: EDR, firewall, directory, cloud.
6. Archive media.

For a virtual machine, a snapshot that includes memory is often the quickest way to freeze everything. Keep the ransom note and a few encrypted files too, as cybermalveillance.gouv.fr recommends.

Keep evidence usable

Evidence is only useful if you can show it has not been altered:

• Hash each copy at the time of collection.
• Record the chain of custody: who collected what, when, where it is stored and who accessed it.
• Work on copies, never on the original.
• Keep the incident log of every action taken on the system, including the isolation itself.

NIST SP 800-86 explains how to build these forensic techniques into incident response.

The most common mistakes

• Rebooting “to see if it comes back”.
• Running a full antivirus clean-up before collection.
• Deleting malicious files or accounts as soon as they are found.
• Reinstalling or restoring before the investigation ends. See When can you restart production after an attack?.
• Tipping off the attacker with a visible, isolated action, when coordinated containment would have cut all their access at once.

What Cyna does

Cyna’s managed SOC relies on SentinelOne or Microsoft Defender, both of which allow remote endpoint isolation. Cyna’s CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly to lead collection and investigation alongside the MSP, which stays in control of its client’s systems. The incident response on-call team is available 24/7 from the Report an incident page.

Talk to an expert

Want to check that your containment procedures preserve evidence properly? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

What if encryption is still running?

Limiting the damage comes first. cybermalveillance.gouv.fr, the French government's cyber assistance service, says a controlled shutdown may then be considered, preferably hibernation, which writes memory contents to disk.

Can you run a full antivirus scan on the isolated machine?

Not before evidence has been collected. A scan may delete or quarantine files the investigation needs and alter access timestamps. The response team decides when.

Should the attacker's account be deleted?

Disabled, yes; deleted, no. A deleted account loses its history and attributes, which help explain what the attacker did. See How do you know the attacker is gone?.

Why keep evidence if you are not pressing charges?

First and foremost for the investigation: without it, you cannot tell how the attacker got in or what they touched. Insurers may also ask for it, and it can support the notifications provided for in applicable regulations.