Forensic Procedures 1. Assess the situation and understand what type of incident or crime is to be investigated. 2. Obtain senior management approval to proceed with an investigation.

Forensic Procedures 3. Carry out procedures to “freeze” audit trail, e.g., sending a court order to the Internet service provider (ISP) to provide access to the suspect’s Internet data, copying s, imaging hard disks, identifying remote storages and imaging the relevant disks and RAM. In some cases, a warrant is necessary. The organization’s lawyers should be consulted with respect to police involvement.

Forensic Procedures 4. Apply packet sniffing. 5. Review system logs. 6. Determine other equipment and software needed to carry out the investigation. 7Apply special software like Encase to recover erased data.

Forensic Procedures 8. Avoid shutting down the suspected computers, connect uninterrupted power supply (UPS) to keep the computer on, so as to prevent loss of data or system audit trail. If UPS is not available and the computer has to be moved, unplug it instead of using the operating system to shut it down; unplugging will involve less interference with the audit trail.

Forensic Procedures 9. Scan imaged drives and copied s for viruses. 10. Back up the evidence. 11. Use the organization’s PKI key recovery process to decrypt files. If that does not work, use password cracking software to obtain the password for the encryption key.

Forensic Procedures 12. Boot the captured or suspected computers with an external boot disk instead of using the computer’s operating system to avoid loss of audit tra 13. Document all sequence of events, all interviews, time spent by each investigator and the work performed by each investigator. 14. Maintain arm’s length with the people being investigated, the requester of the investigation, the approver of the investigation and people who provide information to investigators, to avoid conflict of interest.

Forensic Procedures 15. Continuously assess the need to communicate with the law department, senior management and the police. 16. Do not communicate information about the investigation using post mail or an unencrypted electronic medium. 17. Be a patient listener, ask open questions, make others comfortable in talking to you, take copious notes.

18. Safeguard the investigation files with encryption and physical measures. 19. Keep all evidence, including electronic media for a case all together as complete audit trail, with proper cross references to source, date, sequence of events etc. 20. Dispose of unneeded electronic evidence by using the organization’s approved data wiping software and standard procedures, including if necessary, corporate approved vendors for media storage, backup and destruction.