app dis 7

All evidence you present in a court of law must exist in the same condition as it did when you collected it. Evidence cannot change at all once you collect it; it must be in pristine condition.

You’ll be required to prove to the court that the evidence did not change during the investigation. You’ll have to provide your own evidence that all collected evidence exists without changes as it did when it was collected.

The documentation that provides details of every move and access of evidence is called the chain of custody. The chain starts when you collect any piece of evidence.

Since you don’t know if you’ll have to present evidence in court, you should collect all evidence during an incident investigation as if you will take it to court. If you carefully preserve the chain of custody and do not go to court, you just have well documented evidence. This type of information is great for analyzing incidents for the lessons learned step of incident response. On the other hand, if you are careless in the way you collect evidence and then end up going to court, your carelessness will likely result in having your evidence rejected by the court. Without the evidence you need to prove your case you may not be able to prevail. Always treat each investigation as if it will end up in court.

12

Incident Handling and Management Tools for Microsoft Windows and Applications

Two basic types:

Tools that help manage the CSIRT’s activities and gather information about the incident response process

Tools that collect information about the incident itself

Page ‹#›

Security Strategies in Windows Platforms and Applications

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.