What is the primary purpose of preserving evidence during a cyber incident affecting sensors?

• A. Legal and forensic analysis, and incident attribution.
• B. To prevent future issues.
• C. To slow response.
• D. To clear system logs.

Answer: (A)

Preserving evidence during a cyber incident affecting sensors ensures you have intact, untampered data to understand what happened, when it happened, and who was involved. By keeping logs, memory contents, disk images, network captures, and artifact hashes in a verifiable state and maintaining a clear chain of custody, you enable reliable forensic analysis and credible attribution. This foundation is what lets investigators reconstruct the attack, determine attacker techniques, and support any legal or disciplinary actions if needed. It also helps inform effective remediation and future hardening, though that is a downstream benefit rather than the immediate purpose of preservation. Clearing logs or rushing to respond without preserving evidence would undermine the ability to analyze the incident accurately, and trying to “slow response” contradicts the goal of restoring operations quickly. Preserving evidence, therefore, is about enabling solid analysis and attribution to guide proper resolution and accountability.