Appendix C

Forensics Team Templates

The Forensics Team should always follow a structured documented process, wherein the content of the items to be investigated need to be preserved, validated, and documented.

Templates provide a standardized methodology to follow for each investigative event conducted by the Forensics and/or Incident Response team member. Template types include but are not limited to:

1. Evidence Capture Form

image

2. Chain of Custody Log

image

3. Device Research Form

4. Evidence Review Form

There are certainly other forms ...

Get Computer Incident Response and Forensics Team Management now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.