System Forensics, Investigation, and Response, 3rd Edition

Preserving Evidence

An event is any observable occurrence within a system or network. This includes any activity on the network, such as when a user accesses files on a server or when a firewall blocks network traffic. Adverse events are events with negative results or negative consequences. Attacks on systems are adverse events. Adverse events discussed here are events that are computer-security related. They are not events caused by sources such as natural disasters and power failures. A computer security incident is any event that violates an organization’s security policies. This includes computer security policies, acceptable use policies, or standard security practices. The following are examples of computer security incidents:

NOTE ...