Computer Incident Response and Forensics Team Management

Appendix C

Forensics Team Templates

The Forensics Team should always follow a structured documented process, wherein the content of the items to be investigated need to be preserved, validated, and documented.

Templates provide a standardized methodology to follow for each investigative event conducted by the Forensics and/or Incident Response team member. Template types include but are not limited to:

1. Evidence Capture Form

2. Chain of Custody Log

3. Device Research Form

4. Evidence Review Form

There are certainly other forms ...