The 10 Essentials of Infosec Forensics

1. Know the Investigation's Intent

Maybe you already know an incident is so egregious that your organization plans to prosecute those responsible. More on legal issues in a minute, but suffice it to say that the legal action will dictate both process and tactics.

But not every forensics investigation will have the same purpose — or trajectory. It's not always obvious where to begin. "What questions am I trying to answer, and is this process key to getting the answer?" Motorola's Rushing asks. If there's a faster way to get to the same information, use it, he adds. This is where pragmatism and a little ingenuity come in handy.