Ethical Hacking: Techniques, Tools, and Countermeasures, 4th Edition

Evidence Handling and Administration

An integral part of every incident response is collecting evidence of what happened. Evidence is necessary to identify what happened, the scope of the incident, the extent of the effect, and the source of the incident. Evidence collection is critical to each investigation and can provide the basis for pursuing legal remedies and prosecution after the incident has been resolved. Understanding how to properly conduct evidence collection and handling is fundamental to properly handling incidents and laying a solid foundation for any future legal action.

NOTE

Involving personnel in evidence collection who are not trained to handle evidence properly can result in evidence that is not adequate to prosecute a crime ...