Computer crime evidence-preservation checklist

You've detected a computer crime and decided to report that activity to law enforcement. But before you touch the affected machine, open a single event log, or run another program, you must secure all digital evidence. This checklist tells you what to do and what not to do in the aftermath of a computer crime.

Note: This checklist is an updated version of our Cybercrime evidence-protection checklist.