An incident responder is tasked with collecting forensic evidence from a Programmable Logic Controller (PLC) that is actively controlling a critical industrial process.
The highest priority is to preserve evidence of a potential memory-resident attack without halting the physical process.
Which of the following is the MOST appropriate initial action?
