[CISSP-D] Forensic Investigation

Dear all,

I have a case in here, and hope you can shed a light to me. I am not really 
familiar with forensic investigation.

There is a case where a company is under investigation due to a fraud.

What action to take in term of IT security is to secure all the electronic data 
including current data which still on the server or PC or all electronic
devices. And those that might have been erased from the devices (server, PC, 
other devices).

1. What action to take to secure current electronic data so it can not be 
changed ? USing tripwire for file integrity checking ? But it will not prevent 
from deletion.

2.  What about those data that might be erased. how to retrieve the data.

3. Any forensics tools that can refer and help on both 1 and 2 question

4. any good site to start to learn about forensic?

thank's in advance

rgds

Harry





------------------------ Yahoo! Groups Sponsor --------------------~--> 
$4.98 domain names from Yahoo!. Register anything.
http://us.click.yahoo.com/Q7_YsB/neXJAA/yQLSAA/kgFolB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/CISSP-Discuss/

<*> To unsubscribe from this group, send an email to:
    CISSP-Discuss-unsubscribe@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/