Microsoft Detection and Response Team (DART) AMA

Have a playbook to follow -- identify your requirements and needs before an incident strikes. What are your requirements to gather a disk image or triage data? What tools do you need, and do you have them ready? What stakeholders need to be made aware, for legal and compliance reasons? Do site managers know what they need to do to actually acquire the evidence you need? Plan ahead so that execution can be efficient. It probably won't be perfect even then, but it'll still get your team answers faster. As for live triage vs. deadbox analysis, abide by organizational/evidence preservation/legal and compliance requirements first 🙂 That said, live triage data can be collected and analyzed much more quickly than a disk image can be obtained...