Incident Containment, Eradication, and Recovery 2 -- Containment Strategy 2 -- Evidence