What nonexperts should do first in a computer crime investigation:

This story is part of a Special Report
Click here to see the entire report

Techniques and warnings from the professional investigators.

• Let the Pros Investigate Computer Crimes
• Computer forensics resources
• Forensics Tricks of the Trade

News Story by Dan Verton

JULY 15, 2002 (COMPUTERWORLD)

DO isolate the target system. Bring in legal support, and determine the scope of the investigation.

DON'T power on or boot up the system.

DO obtain copies of backup tapes from the local and regional IT departments within your company. Bag, tag and secure them.

DO preserve the data's evidentiary value by bagging and tagging all hardware, storing it in a vault or secure area and keeping a log of access to evidence.