Preserve before analysis
Identify, acquire and protect relevant data. Record source, time, responsibility and integrity checks.
Scope the question
Incident review, manipulation analysis and formal expert evidence have different requirements. Work should match qualifications and mandate.
Report limits
Separate observations, interpretation, uncertainty and limitations so results can be understood and reproduced.
What to prepare for the first conversation
Describe the event, period, affected systems, your authority and the question to answer. Do not upload original evidence to a general form or make uncoordinated changes. An active incident needs a designated response team. Agree secure handover, responsibilities, time references and reporting limitations in writing before investigation.
Discuss a project ↗