The first hour at Kestrel Joinery, after the office coordinator finds a customer has paid eighteen thousand pounds to an account that is not Kestrel's: four sand timers already running down that nobody started — memory gone at power-off, camera footage overwritten in fourteen days, logs rolling after thirty days and a deleted-items folder that empties itself; the seven helpful instincts that each destroy something, from restarting it to tidying up; and the first ten minutes done right — write down what you saw, photograph the screen, note the time, touch nothing and tell one person who can act.

CY-BEGINNER-051Beginner · Digital Forensics

The First Hour — What To Do When You Find Something

You are not the investigator. Your job is to leave it possible for somebody else to investigate — and most of what makes that impossible is done by helpful people in the first ten minutes, or by a clock nobody at the company set.

11 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Separate finding out what happened from leaving it findable, and name the seven helpful actions that destroy evidence.
Find out what is expiring in your own organisation before anything happens, and who can pause it.
Write a contemporaneous note, photograph a screen properly, and tell one person who can act in three sentences.
Keep a custody record that survives a busy week, hold the line on not looking, and hand over in four lines.

Price:৳5,000