 |
| Tips |
If your computer issue is significant or important to your business, could potentially be involved in a lawsuit, or if there is potential for conflict of interest, then you should hire an experienced computer examiner.
The risk of not hiring a trained/certified forensic professional could result in: |
|
| |
| |
loss or corruption of data |
|
|
not recovering all the data |
|
|
|
|
|
data not admissible in court |
|
|
triggering a valid lawsuit |
|
|
|
| |
Don't trust your company's valuable information assets to anyone not properly trained in computer forensic examinations. Hire a well trained computer forensic professional.
If you suspect there's been a computer crime, your first step should be to talk with your legal counsel and retain a computer forensic examine. In the meantime, to help preserve your evidence, there are some general guidelines to adhere to: |
| |
|
Time is very critical, since computer data can be altered and erased quickly. |
|
|
Do not disturb the computer in question. If the computer is off, leave it off and unplug the power cord to prevent accidental boots. Even turning a computer on/off can change the evidence on the computer. |
|
|
If the computer is on, leave it on - unless it's running a destructive process. |
|
|
If the computer is not on, secure the computer. Move the computer to a secured area with controlled access where no one has access to the computer. It is important to maintain a proper chain of custody. |
|
|
Do not run any programs on a computer in question. Trying to open or view files on a Windows machine can alter or destroy evidence. |
|
|
Do not make any changes to the computer or storage device. Do not insert any removable media into the computer or device, like floppy disks, camera media cards, thumb drives, card readers, etc. |
|
|
|
| |
| * Note: These are general guidelines. All computer incidents will have specific issues which may alter the circumstances under which these steps are implemented to preserve evidence. We cannot be held responsible for any damage or liability resulting from following any of these general guidelines. |
| |
|
|
|
|
|
