Incident Handling
Incident handling often means a criminal investigation. Whenever a criminal activity is suspected, back away from the environment, leave it as is, and contact law enforcement. Unless you are instructed by law enforcement to perform actions to gather evidence, do not do anything. Your actions in looking for, collecting, or analyzing evidence can be easily thrown out of court. This inadmissibility is due to your lack of official training in forensic investigations, your conflict of interest, and the likelihood that you will violate the rules of evidence and/or the chain of custody.
Get CompTIA® Security+™: Study Guide, Fifth Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
