Imagine yourself as the sysadmin of a server which has been successfully hacked. You have just discovered the break-in, and the attacker seems to still be occupying the system.

Normally you will subject the compromised system to a forensic analysis before repairing it and returning it to production use. Give an overview of the actions you would take in preparing the system for analysis, and briefly describe the steps in performing the analysis.