Computer Misuse - What Should I Do If I Suspect?
These are some simple actions to assist you as an HR Manager to ensure that your company is following correct procedures, ACAS guidelines and best practice, and legal requirements.
1. Always have an independent witness to the actions you are taking
2. If the data/images are on a desktop computer: Advise the user that you are carrying out an investigation into the computer usage and Turn off the suspect computer immediately – if possible take out the power supply to the computer, do not use windows to power down the computer. Consider the most appropriate action to be taken at this point against the user of the suspect computer, this may be alternative work, or suspension on full pay whilst the forensic analysis and investigation is being completed.
3. If it is a Laptop computer: Take the power cable out of the computer and remove the battery pack. Again, consider the most appropriate action to be taken at this point against the user of the suspect computer. This may be alternative work or suspension on full pay whilst the investigation and forensic analysis is being completed.
4. Move all of the suspect equipment to a safe, secure lockable storage area.
5. Seal the computer/laptop (ideally seal each suspect piece of equipment in their own ‘professional' plastic exhibit bag), alternatively place it in polythene or Clingfilm wrap and lock away in a secure area.
6. Records: record EXACTLY what you have done to the item from the first minute you touched the suspect computer. State the EXACT time that the equipment was powered down by you, and the EXACT time it was placed in a sealed bag (or wrapping) and the time it was placed in a secure, locked area. Get the independent witness to sign the statement to verify the data recorded by you. Also record your exact conversation and actions taken with the employee(s) involved in using the equipment.
7. CONTACT DISKLABS IMMEDIATELY these actions have been taken.
8. The Disklabs specialist HRProACT team will attend and conduct a detailed forensic analysis and produce a comprehensive professional report which if necessary can be produced in a court of law or tribunal.
9. The Disklabs HR Consultants will be available to advise you and/or your managers and staff on the appropriate actions to take regarding the people management issues. This will include investigative interviews, rights of representation, statements and witnesses, disciplinary procedures, and if necessary preparation for Court of Law or Employment Tribunal hearings. Also ensuring that ACPO (Association of Chief Police Officers) guidelines are understood and followed where appropriate or applicable.
Simon Steggles MBCS
Director
disklabs®
t +44 (0)1827 50000
f +44 (0)1827 66666
m +44(0)7973 210 895
w http://www.disklabs.com
w http://www.computer-forensics.co.uk
w http://www.mobilephoneforensics.com
w http://www.satnavforensics.com
e mailto:simon.steggles@disklabs.com
These are some simple actions to assist you as an HR Manager to ensure that your company is following correct procedures, ACAS guidelines and best practice, and legal requirements.
1. Always have an independent witness to the actions you are taking
2. If the data/images are on a desktop computer: Advise the user that you are carrying out an investigation into the computer usage and Turn off the suspect computer immediately – if possible take out the power supply to the computer, do not use windows to power down the computer. Consider the most appropriate action to be taken at this point against the user of the suspect computer, this may be alternative work, or suspension on full pay whilst the forensic analysis and investigation is being completed.
3. If it is a Laptop computer: Take the power cable out of the computer and remove the battery pack. Again, consider the most appropriate action to be taken at this point against the user of the suspect computer. This may be alternative work or suspension on full pay whilst the investigation and forensic analysis is being completed.
4. Move all of the suspect equipment to a safe, secure lockable storage area.
5. Seal the computer/laptop (ideally seal each suspect piece of equipment in their own ‘professional' plastic exhibit bag), alternatively place it in polythene or Clingfilm wrap and lock away in a secure area.
6. Records: record EXACTLY what you have done to the item from the first minute you touched the suspect computer. State the EXACT time that the equipment was powered down by you, and the EXACT time it was placed in a sealed bag (or wrapping) and the time it was placed in a secure, locked area. Get the independent witness to sign the statement to verify the data recorded by you. Also record your exact conversation and actions taken with the employee(s) involved in using the equipment.
7. CONTACT DISKLABS IMMEDIATELY these actions have been taken.
8. The Disklabs specialist HRProACT team will attend and conduct a detailed forensic analysis and produce a comprehensive professional report which if necessary can be produced in a court of law or tribunal.
9. The Disklabs HR Consultants will be available to advise you and/or your managers and staff on the appropriate actions to take regarding the people management issues. This will include investigative interviews, rights of representation, statements and witnesses, disciplinary procedures, and if necessary preparation for Court of Law or Employment Tribunal hearings. Also ensuring that ACPO (Association of Chief Police Officers) guidelines are understood and followed where appropriate or applicable.
Simon Steggles MBCS
Director
disklabs®
t +44 (0)1827 50000
f +44 (0)1827 66666
m +44(0)7973 210 895
w http://www.disklabs.com
w http://www.computer-forensics.co.uk
w http://www.mobilephoneforensics.com
w http://www.satnavforensics.com
e mailto:simon.steggles@disklabs.com
Source...