Preparing for Forensic Analysis

This chapter is intimately linked with Incident Response. First you respond to an incident to contain it, then you must analyze it. It is important to find the root cause, or the criminal will return to your network (or worse yet, never leave.) While the incident response chapter focuses more on the business side of what is important, this chapter introduces technical issues of how to find information and track it. This chapter addresses three areas of expertise that must occur simultaneously during a forensic investigation: forensic analysis skills to select and analyze the forensic evidence, technical forensic skills to access the forensic evidence, and legal evidence skills to meet legal requirements for authenticity and chain of custody.