Always follow a propoer Digital Forensics Procedure, many can be found on the internet but for guidance one of the following can be used:
SANS Digital Forensics and Incident Response Poster
Forensic Process Lifecycle
Always remober because you are responsible for an evidence, it means you have to show "chain of custody" by following proper procedure and protect the integrity of an evidence all the way to its dispostion.
Very nice blog post... Incident response cyber extends your ability to respond to cyber threats to minimize the duration, impact and cost of a security breach.
ReplyDelete