To protect the backup as evidence, preserve the second backup media in a secure location and preserve the chain of custody. Do not use this copy for any operational task. In specific instances or for critical environments, the backups are used to reinstall the compromised system on other hosts and hard drives while the original hosts and hard drives are preserved as evidence. This approach preserves the original environment most accurately even though it may alert an intruder and require significant hardware resources. If you take the system offline and try to back it up, all logs may be lost.
Intruders regularly establish more entry points into a network once they have gained initial access.
Intruders perform scans across large ranges of IP addresses to locate security vulnerabilities. These systems provide access to users from other systems within the same domain without further authentication. Such traces include log and audit files, files left behind by an intruder, or information about the use of servers and services on other systems used in moving through the network. This trace information can be used to search for other events or connections originating from that system that were previously unnoticed. In this way, you can identify other systems to which an intruder gained access.