Also do the following. Document, use, and maintain a procedure for preserving the compromised system and any associated evidence in case of a criminal investigation. Analyze a replica of a compromised resource, not the original, whenever possible, to avoid inadvertently tampering with evidence. Ensure that replicating the compromised resource does not change the original. This can be accomplished by write-protecting the original information prior to copying it.
Ensure evidence is captured and preserved securely.
Ensure that all log files containing information regarding an intrusion are retained for at least as long as normal business records and longer, if an investigation is ongoing. Ensure that all critical information is duplicated and preserved both onsite at your facility and offsite in a secure location. This includes policies, procedures, contact information, tools, critical data, configurations, databases, cryptographic checksums, and system backups. Onsite alternative storage provides for quick access in the event of an emergency. Define and document a procedure for authorizing access to both onsite and offsite information so you can access it quickly in case of an emergency.