When you discover that a system may be compromised, the instinct is to act fast. Acting fast is right, but acting carelessly can make recovery and investigation much harder.
Do: isolate, do not power off
Disconnect affected devices from the network by unplugging the network cable or disabling Wi-Fi. Avoid switching them off where possible, because valuable evidence held in memory is lost when a device is powered down.
Do: write everything down
Record what you noticed, when, and every action taken. Accurate timelines are essential for investigation, insurance and any legal process.
Do: preserve logs
Make sure firewall, server, email and application logs are not overwritten. Many systems rotate logs automatically after a short period.
Avoid: running clean-up tools immediately
Antivirus scans and clean-up utilities can delete or alter the very artefacts an investigator needs. Contain first, then investigate, then clean.
Avoid: communicating over compromised channels
If email may be compromised, coordinate the response by phone or a separate, trusted channel.
Get qualified help
A digital forensics practitioner can acquire evidence correctly, maintain chain of custody and help you understand what happened and how to prevent it happening again.