[CISSP-D] Re: Forensic Investigation

Regarding Harry Lim's Computer Forensics question:

Do NOT do anything to the machine(s) in question.

If on:  Do not turn off.
If off:  Do not turn on.

You may (in most cases) simply unplug the machine from the network, if 
feasible.  But, frankly, if the machines are part of a company's 
infrastructure and network this will be close to impossible unless the 
entire company really is being investigated.  In large cases like this, it 
is the governmental agency's responsibility to acquire this evidence, not 
an individual's.

Call a Certified Computer Examiner or other Forensic professional.  DO NOT 
attempt to mess around with the hardware or any files.  If you already 
have, sorry, it probably is too late, AND whatever you may've obtained may 
not be usable for any court case.

This is imperative.

Don't fool around with this issue.  If you do (like attempting to "copy" a 
hard drive or whatever) it will NOT be admissible in court.


Alex Santa-Pinter, CISSP





------------------------ Yahoo! Groups Sponsor --------------------~--> 
Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar.
Now with Pop-Up Blocker. Get it for free!
http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/kgFolB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/CISSP-Discuss/

<*> To unsubscribe from this group, send an email to:
    CISSP-Discuss-unsubscribe@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/