Chapter 1 : Computer Forensics / Topic : Incident Verification and System Identification / Content : activities in initial response and phase after detection/identification of an incident initial response phase obtaining preliminary information documenting steps to take 1-establishing an incident notification procedure 2-recording the details after initial detection a-general information b-more specific details case notes 3-incident declaration 4- assembling the csirt a-determining increase procedures b-implementing notification procedures c-scoping an incident and assembling the appropriate resources