1. Know the Investigation's Intent
Maybe you already know an incident is so egregious that your organization plans to prosecute those responsible. More on legal issues in a minute, but suffice it to say that the legal action will dictate both process and tactics.
But not every forensics investigation will have the same purpose — or trajectory. It's not always obvious where to begin. "What questions am I trying to answer, and is this process key to getting the answer?" Motorola's Rushing asks. If there's a faster way to get to the same information, use it, he adds. This is where pragmatism and a little ingenuity come in handy.
(Image: Stepan Popov – stock.adobe.com)