How do Incident Response get samples in infected machine

I was studying malware analysis on some malware samples and it got me thinking of how researchers get these samples, because some malwares delete the first file that started the infection and most malwares try to obfuscate the infection... So, how do researchers get samples after the machine got infected?

analysis cybersecurity delete file incident incident response infection machine malware malware analysis malwares researchers response thinking try