Unfortunately we work events and incidents every day. Some are worse than others, but the one rule of incident handling is that every incident must be handled as if it were going to end up in court. Gathering evidence should begin as soon as it is identified. Every incident handler should have a bound incident log book with numbered pages. Once you begin to work an incident, record every detail into the journal. Every handler should be recording their efforts, too. This becomes collaberative evidence in court. Make sure to date and initial every entry. Mari Nichols iMarSolutions |
Mari Nichols 76 Posts Oct 12th 2008 |
Thread locked Subscribe |
Oct 12th 2008 1 decade ago |
In the article you state:
...More "incident responders" should take the time to play with Helix in simulations/exercises... That sounds great. DO you know of any such events? Maybe a webgoat of the forensics world for Helix? |
Anonymous |
Quote |
Oct 13th 2008 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!