The whole category in one page.
PRESERVE BEFORE YOU EXAMINE, BECAUSE THE OPPORTUNITY EXISTS ONCE
Most evidence is destroyed by the first responder acting reasonably but wrongly — logging in to look around, deleting what seems malicious, or rebuilding the system immediately.
TRAIN WHOEVER FINDS THESE THINGS TO DO THREE THINGS ONLY: STOP USING THE SYSTEM, DELETE NOTHING, AND TELL SOMEONE
REQUEST LOG PRESERVATION FROM PROVIDERS IMMEDIATELY, SINCE THEY DISCARD ON A SCHEDULE AND CANNOT RECOVER AFTERWARDS
WORK ON COPIES, RECORD WHO HELD WHAT AND WHEN, AND KEEP A VERIFICATION VALUE PROVING THE COPY HAS NOT CHANGED
Evidence whose handling cannot be accounted for is challenged successfully.
NEVER ASSUME THE INCIDENT BEGAN WHEN YOU NOTICED IT — WORK BACKWARDS, BECAUSE COMPROMISES ARE USUALLY PRESENT LONG BEFORE DISCOVERY
FIND EVERY ROUTE BACK IN BEFORE DECLARING IT CLOSED, PARTICULARLY NEW ACCOUNTS AND SCHEDULED TASKS
ACCESS UNDER AN ACCOUNT DOES NOT ESTABLISH WHO ACTED, SINCE ACCOUNTS ARE SHARED AND COMPROMISED — SEPARATE FACT FROM INFERENCE IN EVERYTHING YOU WRITE
FOR EMPLOYMENT INVESTIGATIONS, MONITORING NOT DISCLOSED IN ADVANCE MAY BE UNLAWFUL AND THE FINDINGS UNUSABLE — KEEP SCOPE PROPORTIONATE TO THE CONCERN
DO NOT CONFRONT A SUSPECTED PERSON BEFORE EVIDENCE IS PRESERVED, AND DISABLE DEPARTING STAFF ACCOUNTS RATHER THAN DELETING THEM
AND ENABLE THE LOGGING AND RETENTION NOW THAT YOU WILL NEED LATER, BECAUSE IT CANNOT BE RECONSTRUCTED AFTER THE FACT
