An intrusion has occurred in an internet facing system. The security administrator would like to gather forensic evidence while the system is still in operation...