Computer Incident Response and Forensics Team Management

Part 2. Forensics Team

This part will present the concepts and principles security professionals and managers need to know to conduct or oversee a forensics investigation team. It will discuss how managers are responsible for establishing and following policies and procedures, as well as certifying personnel and their levels of expertise. The sections will explore forensics team management, critical chains of evidence collection and custody, and the laws, ethics, regulations, and boundaries for investigations, and the investigators. This part also will present the relationships the forensics manager should develop including technical, management, law enforcement, and civil relationships with professionals and organizations.

The First Digital Forensics ...