Using Forensics Data 5.5

Question 1

Preservation

Answer 1

There will be a lot of data to keep. It’s important for the current investigation, and there may be need for it in future investigations to see if there are any correlations or if it needs to be revisited. New items of interest could be discovered and you’ll need the data to explore them.

Question 2

Recovery

Answer 2

Strategic intelligence gathering can help you. The more data you have the more you can have a strategy for the next time. This will also help you develop counterintelligence for your attacker and you might be able to use that to your advantage later. Log everything, everywhere, you can track every step that was taken.

Question 3

Track Man Hours and Expenses

Answer 3

Some incidents can use massive resources. This may have an impact on the bottom line. You must track all of the man hours and expenses associated with the investigation. Try to be as accurate as possible, it may be required for a legal environment where restitution may be possible.