Digital Forensics, Investigation, and Response 5E, 5th Edition

Preserving Evidence

An event is any observable occurrence within a system or network. This includes any activity on the network, such as when a user accesses files on a server or when a firewall blocks network traffic. Adverse events are events with a negative result or negative consequences. Attacks on systems are adverse events. Adverse events in this book are events that are computer security-related. They are not events caused by factors such as natural disasters and power failures.

A computer security incident is any event that violates an organization’s security policies. This includes computer security policies, acceptable use policies, and standard security practices. The following are examples of computer security incidents:

• Denial-of-service ...