The Ethical Hacker Network - Forensic case data retention

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Forensics (Moderator: don) > Forensic case data retention

Pages: [1] Go Down

« previous next »

	Author	Topic: Forensic case data retention (Read 4881 times)
0 Members and 1 Guest are viewing this topic.

jimbob

Guest

Forensic case data retention

« on: September 05, 2007, 03:21:29 AM »

Hi,
I was wondering what the view was on retaining data from forensics cases you've worked on. Is the consensus that it is prudent to delete all evidence and work product following the conclusion of a case, or do people retain this for a period of time? I'm thinking of cases outside law enforcement where there are well defined guidelines on evidence retention.

Regards,
Jimbob


	Logged

dalepearson

Sr. Member

Offline

Posts: 357

Re: Forensic case data retention

« Reply #1 on: September 05, 2007, 10:00:01 AM »

Unless there is a legal requirement or a legislative requirement to your company for data preservation then I don’t think there is a need to store this after a case has ended.

However if storage is not an issue, I would consider saving for 6 - 12 months incase something to do with the case reopens, in either case I would seek guidance from the legal / compliance department to cover your own back.


	Logged

:: Subliminal Hacking :: / :: Security Active Blog ::

d1spat3r

Newbie

Offline

Posts: 28

Re: Forensic case data retention

« Reply #2 on: September 05, 2007, 10:28:19 AM »

We have a policy that all data is retained for cases for a minimum of 3 years no matter what type of case. This policy was designed by our legal department (and is under review at the end of the year).

If this is for a small shop then it really depends. If the case might go to trial then i would store the information for a longer period of time.