When is the best time to contact a computer forensics expert?
As soon as possible preservation is the key. How do I remove a computer that is turned on? Pull the power cord from the back of the computer; do not shut it down normally. This will preserve the volatile data that would be lost once the computer is shutdown and/or rebooted. Volatile data can include important information such as what documents were printed, clipboard contents and data in memory. The information may be critical to the evidence. Can I just have an image taken of a device? Yes. This is referred to as preservation only. Once the device is imaged, you are free to redeploy the machine back into the working environment. Cant my IT person or another employee look through the data? Absolutely not; every time the drive is turned on and accessed, data is being changed, deleted and/or overwritten. Another question worth asking is Do I feel comfortable putting that person on the witness stand instead of a forensic specialist? What industries does computer forensics deal with? Some
