SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-dont-shut-down-first

According to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?

Do not shut it down. Volatile evidence may be lost.

Start playing free

  1. Shut it down ✔
  2. Photograph its screen
  3. Document the time

Why: Powering off wipes memory and may trigger attacker scripts that destroy evidence. RFC 3227 also says not to trust programs on the system and to run your tools from protected media.

Huh, didn't know that: RFC 3227 also warns against running programs like tar or xcopy that change every file's access time.

The dad joke
What do you call an indie rock group that sings about computers? An Alt-Delete band.
Like this card?
Play the game

References

Answer: Shut it down. Powering off wipes memory and may trigger attacker scripts that destroy evidence. RFC 3227 also says not to trust programs on the system and to run your tools from protected media.

  1. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227
    Don't shutdown until you've completed evidence collection.
    Checked 2026-10-10.
  2. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227
    Don't trust the programs on the system.
    Checked 2026-10-10.
  3. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227
    Don't run programs that modify the access time of all files on the system (e.g., 'tar' or 'xcopy').
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhen collecting evidence from a live compromised system, which data should you capture first?Security & PrivacyWhat does a chain of custody record for digital evidence?Security & PrivacyIn digital forensics, what is a write-blocker used for?

That's stuff everyone should know.