Initial Action

• The initial action(s) will determine what data will be lost and what might be preserved.

• Determine what has already been done.

• Some data MUST always be lost!

  • Decide which data may be lost
  • Document what is preserved
  • Document what is lost
  • Document all actions taken

• Some risk will always be involved

  • Attackers may have planted trojans
  • Attackers may have "dead-man switches"
  • Attackers may have installed a self-destruct

Notes: