Preparations to Examination

• So. You've got an incident. Now what?

• Get the examiners together.

• Start log books immediately!

• Notify responsible management contacts.

• Document the nature of the incident.

• Decide if it is serious enough to warrant a forensic examination or just an incident response.

• Decide if law enforcement might get involved.

• Determine what other people have done and have not done.

• Initiate your incident response plan and document everything carefully.

Notes: