Electronic evidence : a basic guide for first responders ; good practice material for CERT first responders

Threats to cybersecurity and cyber-attacks respect no boundaries. For that reason ENISA in the last couple of years has helped to bridge the gap between the CERT- and the law enforcement communities. This report is a continuation of the work of ENISA in this field, and aims at providing a guide for first responders in the area of gathering of evidence related to a cybercrime. While the securing of digital evidence is ultimately a task and a responsibility of law enforcement, CERT staff can nevertheless contribute to that work by helping to preserve it during for example the detection of a cybercrime. This guide does not intend to be exhaustive, nor does it aim to be a full step-by-step guide on how to approach digital evidence as a first responder. Gathering of evidence for example typically involves ad hoc decisions that need to be made during the process, based on factors that cannot be determined in advance. Instead, this guide aims at explaining the principles of sound evidence gathering and tries to raise the right questions to be asked by first responders before starting to work. The document starts with an explanation what is understood by "electronic evidence". Different definitions are presented as well as different sources of electronic evidence (laptops, PDAs, etc.).