One - Identify the scope of the incident and the host systems and/or removable drives that are likely to contain evidence. If appropriate, these systems should be isolated from the network., Two - Document the scene of the incident using photographs and ideally video and audio. Investigators must record every action they take in identifying, collecting, and handling evidence., Three - Gather any available evidence from a system that is still powered on, using live forensic tools to capture the contents of cache, system memory, and the file system., Four - If appropriate, disable encryption or a screen lock and then power off each device., Five - Use a forensic tool to make image copies of fixed disk(s) and any removable disks., Six - Make a cryptographic hash of each source disk and its forensic image. This can be used to prove that the digital evidence collected has not been modified subsequent to its collection., Seven - Collect physical devices using tamper-evident bags and a chain-of-custody form, and transport to secure storage.,

Incident Response Steps

аутор
Угради

Табела

Визуелни стил

Поставке

Промени шаблон

Врати аутоматски сачувано: ?