Why, When, and Who

• Why would you do a forensic examination?

  • When required by Management
  • When required by the Courts
  • When Law Enforcement may be contacted
  • When legal action is a significant consideration or possiblity

• Start as soon as possible.

  • Time lost is time when changes can be made
  • Evidence can be lost during delays
  • Doubt accumulates during delays

• Examination should be done by trained people.

  • More than one person
  • No vested interest in outcome - avoid conflicts of interests

• You never know how deep the rabbit hole goes

Notes: