ABSTRACT
In this chapter, we will discuss the various issues that can stall or stop an investigation. Not all investigations continue until they are solved. In some cases, the investigation must stop in order to return affected systems to proper operation. In some cases, management may decide that enough money has been spent on an investigation with no results. Finally, and most unfortunately, investigations stop for political reasons. We’ll explore these situations in this chapter, before we move on to discuss preparation for investigating computer security incidents.
