B. You don't do a forensic intrusion investigation by shutting down a single server and moving it.
Modern malware can run just in memory, meaning of shut off the computer to move it, you lose the evidence.
In digital forensics and incident responses, you want to look at the whole network. And you usually have to do this over time to see what the invaders are trying to do.
To do this they use forensic imaging software which basically creates a snapshot of the whole system at that time and you can see what's happening in memory and you're getting the network not just a single server
A. It didn't happen.
B. You don't do a forensic intrusion investigation by shutting down a single server and moving it.
Modern malware can run just in memory, meaning of shut off the computer to move it, you lose the evidence.
In digital forensics and incident responses, you want to look at the whole network. And you usually have to do this over time to see what the invaders are trying to do.
To do this they use forensic imaging software which basically creates a snapshot of the whole system at that time and you can see what's happening in memory and you're getting the network not just a single server