0

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I suspect, got in and erased many personal and system files.

I took a quick look at the windows event log and I see someone logging in at the time of the intrusion. I need an expert advice, but I have no idea what to look for in a person for this sort of task.

Any advice?

(windows 7 x64)

1 Answer 1

3

Since you mention you need to prove intrusion for legal purposes then it sounds like you may need to check into a certified computer forensics investigator. Hopefully the system is turned off (to avoid damaging evidence) until you decide whether or not to pursue forensics.

Here are a couple of links that might be helpful:

http://en.wikipedia.org/wiki/Computer_forensics

http://www.computerforensicscompanies.com/

2
  • I've always been told to never turn a system off if you plan on pursuing an investigation. Forensics specialists like to be able to dump the memory, see what processes are running, etc. Not sure if this is one of those things that different people feel differently about though.
    – Kasius
    Sep 25, 2012 at 19:22
  • 1
    @Kasius It varies depending on the problem. If you suspect the system is going to self-destruct and destroy evidence then crashing it hard is sometimes better than letting it self-destruct. Conversely if the "interesting" code is only in RAM pulling the plug destroys any chance at capturing that data. (You also need to consider the observer effect when acquiring memory dumps)
    – voretaq7
    Sep 25, 2012 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .