If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:

When civil litigation is a goal, the primary concern is the admissibility and integrity of evidence in a court of law. The chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of evidence. Establishing and meticulously documenting the chain of custody from the moment evidence is identified is the foundational step. Failure to do so can lead to the evidence being challenged and deemed inadmissible, which would undermine the entire legal proceeding. All other evidence collection and analysis activities are contingent upon this legally required process.

A. contact law enforcement.

This is appropriate for criminal matters, but civil litigation is a dispute between parties and does not necessarily involve a crime requiring law enforcement.

C. capture evidence using standard server-backup utilities.

Standard backup tools are not forensically sound as they can alter metadata (e.g., access times) and do not capture a complete bit-for-bit image, thereby contaminating evidence.

D. reboot affected machines in a secure area to search for evidence.

Rebooting a system destroys all volatile data in RAM, such as running processes and active network connections, which is often critical evidence for an investigation.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management

Section 4.5

Evidence Collection and Forensics. The manual states

"The chain of custody must be maintained for all potential evidence... If the chain of custody is broken at any point

the evidence may be rendered inadmissible in a court of law." (p. 238).

2. National Institute of Standards and Technology (NIST) Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.2

"Chain of Custody

" explicitly states

"A complete chain of custody log is necessary for evidence to be admissible in a court of law. The log should contain information for each piece of evidence

such as item number

description

acquisition and disposition dates and times

and the individuals who handled the evidence." (p. 24).

3. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. This is a foundational academic text in digital forensics. Chapter 3

"Legal Aspects of Digital Forensics

" emphasizes that "maintaining a proper chain of custody is essential for the evidence to be admissible in court... The chain of custody demonstrates that the evidence has not been altered or tampered with." (pp. 89-91).