Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I suspect, got in and erased many personal and system files.

I took a quick look at the windows event log and I see someone logging in at the time of the intrusion. I need an expert advice, but I have no idea what to look for in a person for this sort of task.

Any advice?

(windows 7 x64)

share|improve this question

migrated from superuser.com Sep 25 '12 at 20:33

1 Answer

up vote 3 down vote accepted

Since you mention you need to prove intrusion for legal purposes then it sounds like you may need to check into a certified computer forensics investigator. Hopefully the system is turned off (to avoid damaging evidence) until you decide whether or not to pursue forensics.

Here are a couple of links that might be helpful:

http://en.wikipedia.org/wiki/Computer_forensics

http://www.computerforensicscompanies.com/

share|improve this answer
I've always been told to never turn a system off if you plan on pursuing an investigation. Forensics specialists like to be able to dump the memory, see what processes are running, etc. Not sure if this is one of those things that different people feel differently about though. – Kasius Sep 25 '12 at 19:22
1  
@Kasius It varies depending on the problem. If you suspect the system is going to self-destruct and destroy evidence then crashing it hard is sometimes better than letting it self-destruct. Conversely if the "interesting" code is only in RAM pulling the plug destroys any chance at capturing that data. (You also need to consider the observer effect when acquiring memory dumps) – voretaq7 Sep 25 '12 at 19:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.