Containment, preservation and recovery

Definition and example

Containment, preservation and recovery is the focus of this lesson. Containment limits harm, preservation protects evidence and recovery restores trusted service. Actions should be authorized and recorded. Practice: Create a short note for ‘Containment, preservation and recovery’ in a local training document. Apply the idea to a fictional or deliberately provided sample, record what you checked, and note one limitation. Do not use real credentials, private records or systems without written permission. The task asks you to apply that idea in a small example: Which goal is served by preserving a forensic copy before cleanup. Before you run the code, predict what should happen. Then Inspect the result produced by the exercise and compare it with your prediction. If the result differs, change one relevant line and run it again. Testing one change at a time makes the cause of a result easier to understand.