Digital Forensics and Incident Response - Second Edition

Writing the Incident Report

An incident response team functions in much the same way that a fire department does. Both teams take time to prepare themselves with training on their respective techniques, tools, and practices, and they can respond at a moment's notice to a fire or an incident. During their response to a fire, the firefighters take notes and record their actions, ensuring that critical decisions are documented and that individual contributions are noted. Once the fire is out, they sift through the debris to determine what the causes and origins of the fire were. Once the proper documentation has been prepared, the fire department conducts an after-action review in order to critique their performance and find avenues for improvement. ...