|
|
If you think you have an INCIDENT or EMERGENCY
Call the NetEvidence Incident Support line at 800-240-7120 or
Email:
DO NOT TURN ON OR ATTEMPT TO INVESTIGATE A SUSPECT COMPUTER
THIS WILL DESTROY EVIDENCE!!!
What steps should I take when securing digital evidence?
Identify all computers and storage media that may contain evidence including:
- The suspect's desktop or laptop computer
- The suspect's e-mail account
- The suspect's secretary's or assistant's computer
- The suspect's electronic organizer or Personal Digital Assistant (PDA)
- File Server Content the Suspect has rights to access
- Back-up tapes containing e-mail and files of the suspect
- Voicemail messages from the suspect's extension
- Cell phone address book of the suspect
- Home computer systems of the suspect
- Identify third-party accounts such as hotmail, yahoo mail, msn, etc.
Quarantine the above computers and media
- Do not permit anyone to use the relevant computers or systems
- Disconnect the relevant computer from any network
- Restrict remote access
- Consider the need for court orders to preserve and secure the evidence on third party computers and storage media
Have NetEvidence, Inc. create evidentially sound images of the relevant computers, accounts, storage media, and other content for investigation with the proper handling and chain of custody procedures.
Once evidentially sound images of the date have been made, the computers can go back into circulation and regular use.
|
|
|
NetEvidence Home Page
