ABSTRACT
Introduction The initial response to an incident involving computers or electronic evidence can originate from a variety of sources. A complaint can be received at a corporate security hotline or a surveillance activity can provide an indication of a policy violation or a possible criminal activity. A law enforcement agency might request assistance in an investigation that has uncovered electronic evidence.
