SANS Digital Forensics and Incident Response Blog: Tag - discovery

Lawyers Can Help You Document

Notebook photo courtesy of adulau at flickr.com


photo courtesy of adulau at flickr.comIt is widely accepted that technical people don't document their work. That has proven, annecdotally, to be true among the techs with whom I work. If documentation gets done at all by techs, it is the very last thing completed, and usually needs to be reworked a few times before it's usable. However, forensics requires good documentation. Legal expects and needs most the thing we often would like to put off or skip entirely.

Michael R Anderson, of New Technologies, Inc., a forensics services firm, writes that "proper documentation of the steps taken during the evidence

...