AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/secplus-dont-shut-down-first

According to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?

Start playing free

  1. Shut it down
  2. Photograph its screen
  3. Document the time

🔒 The answer is for AhaBulb members. Members see the answer, why it's right and the official sources for every card of Stuff Every Security Pro Should Know, plus timed practice exams.

The first 50 cards of every test are free to play.

Play the free cards See membership

Like this card?
Play the game

References

  1. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227 Checked 2026-10-10.
  2. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227 Checked 2026-10-10.
  3. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227 Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhen collecting evidence from a live compromised system, which data should you capture first?Security & PrivacyWhat does a chain of custody record for digital evidence?Security & PrivacyIn digital forensics, what is a write-blocker used for?

That's stuff everyone should know.