Evidence Active incident
If you are dealing with an active incident, the instinct to reboot, wipe, reinstall or clean up can destroy evidence. Most of what an investigation needs is still on the machine right now—and only right now.
Line answered 24/7 · Response begins with preservation, not cleanup
Take these steps immediately.
These actions can destroy the evidence you need.
Report an active incident
Call or email for the fastest response. The form is for cases where writing it down is easier than saying it—include times, what you noticed, and what has already been changed.
