General discussion


DOWNLOA Computer crime evidence-preservation checklist

By Bill Detwiler Editor ·
You've detected a computer crime and decided to report that activity to law enforcement. Before you touch the affected machine, open a single event log, or run another program, you must secure all digital evidence. Yet the steps necessary to maintain the integrity of digital evidence often run contrary to common IT practices. Our Computer crime evidence-preservation checklist tells you what to do and what not to do in the aftermath of a computer crime.

Download and review the checklist:

Then, use this discussion to share your experiences with the aftermath of computer crime.

Also, let us know if our Computer crime evidence-preservation checklist provided helpful information and if there's anything we can do to improve the document's format.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

Damage threshold

by Info-Safety, LLC In reply to DOWNLOAD: Computer crime ...

It would be helpful to include information regarding the dollar value damage threshold that needs to be crossed, to save a lot of time and money.

Craig Herberg

Collapse -

Consideration for reporting or evidence-preservation?

by Bill Detwiler Editor In reply to Damage threshold

Thanks for the feedback, but I'm not sure I understand your suggestion.

Are you suggesting that a dollar damage threshold would help organizations decided which activities to report or when to preserve digital evidence?

Collapse -

Re: Consideration for reporting or evidence-preservation?

by Info-Safety, LLC In reply to Consideration for reporti ...

In my experience, the police are not interested in investigating computer breakins below a certain $ threshold. This may not be the case in other jusisdictions, nor would it be true in certain other cases, especially those involving national security.

Clearly, there may be other reasons to preserve digital evidence, but as far as reporting to the police, it is helpful to know if they will want to investigate.

Related Discussions

Related Forums