Digital Forensics Resources for Counsel, Executives and IT

Digital Forensics

Prepare Computers for Evidence Preservation

Record ownership, custody, access and preservation decisions before computers or storage media are handled for an examination.

PDF guide

Digital Forensics

Prepare Mobile Devices for Preservation

Record device ownership, account details, access arrangements and handling decisions before an examiner collects mobile evidence.

PDF guide

Cybersecurity

Incident Response Readiness

Review response roles, escalation decisions, evidence handling and recovery preparations. Use the questions to document your next actions.

PDF guide

OT and Critical Infrastructure

Prepare for an OT Security Review

Gather the process scope, system inventory, access records and operating constraints before meeting an assessment team.

PDF guide

Audit Preparation

Complete OT Assessment Planning Library

The sector planning packs and state research companion together in one download for teams preparing an operational technology review.

Downloadable resource pack

Audit Preparation

NYDFS Cybersecurity Preparation Pack

Prepare the entity details, responsible staff and technical records for a financial services cybersecurity review. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

Audit Preparation

New York Private Information Preparation Pack

Map private information, safeguards and record owners before a New York privacy review. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

Cybersecurity

Defense Contractor Cybersecurity Preparation Pack

Organize contract scope, information systems and cybersecurity evidence for a defense contractor review. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

Audit Preparation

Export Control Evidence Preparation Pack

Identify the information, access arrangements and questions counsel needs to scope an export control evidence review. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

OT and Critical Infrastructure

OT Assessment Preparation Worksheet

Record the scope, staff, system information and preparation tasks for your assessment discussion.

Editable CSV worksheet

Digital Forensics

Employee Departure Preparation Pack

Identify devices, accounts, custodians and business records before routine employee offboarding changes them. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

eDiscovery

Commercial Contract Evidence Preparation Pack

Organize the systems, communications and questions relevant to a commercial contract matter. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

Digital Forensics

Medical Matter Evidence Preparation Pack

Identify the devices, accounts, records and responsible staff involved in a medical evidence matter. Includes the topic worksheets and supporting reference material.

Downloadable resource pack

OT and Critical Infrastructure

Water and Wastewater Planning Pack

Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.

PDF guide

OT and Critical Infrastructure

Power and Energy Planning Guide

Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.

PDF guide

Audit Preparation

New York Utility Preparation Pack

Download the planning manual and editable project records together to organize scope, evidence requests and responsibilities.

Downloadable resource pack

Audit Preparation

New Jersey Utility Preparation Pack

Download the planning manual and editable project records together to organize scope, evidence requests and responsibilities.

Downloadable resource pack

OT and Critical Infrastructure

Manufacturing Planning Guide

Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.

PDF guide

OT and Critical Infrastructure

Transportation Planning Guide

Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.

PDF guide

All resources

Five Standards Readiness Checklists

An editable workbook covering OT security, incident response, media sanitization, backup recovery and water system remote access, with questions and evidence fields.

Editable Excel workbook

Digital Forensics

Evidence Gathering Reference Guide

A practical reference for organizing the systems, record owners and questions needed before an audit or examination.

PDF guide

Digital Forensics

Complete Evidence Preparation Library

The information gathering reference and topic packages together for legal, business and technical teams preparing an engagement.

Downloadable resource pack

Audit Preparation

NYDFS Cybersecurity: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

Audit Preparation

New York Private Information: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

Cybersecurity

Defense Contractor Cybersecurity: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

Audit Preparation

Export Control Evidence: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

Digital Forensics

Employee Departure: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

eDiscovery

Commercial Contract Evidence: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

Digital Forensics

Medical Matter Evidence: Records Checklist

Assign the records to gather and track preparation work.

Editable CSV worksheet

All resources

Preparation Questions Register

Track open questions, decisions and the person responsible for the next response.

Editable CSV worksheet

Audit Preparation

NYDFS Cybersecurity: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

Audit Preparation

NYDFS Cybersecurity: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Audit Preparation

NYDFS Cybersecurity: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

Audit Preparation

New York Private Information: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

Audit Preparation

New York Private Information: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Audit Preparation

New York Private Information: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

Cybersecurity

Defense Contractor Cybersecurity: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

Cybersecurity

Defense Contractor Cybersecurity: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Cybersecurity

Defense Contractor Cybersecurity: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

Audit Preparation

Export Control Evidence: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

Audit Preparation

Export Control Evidence: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Audit Preparation

Export Control Evidence: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

Digital Forensics

Employee Departure: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

eDiscovery

Employee Departure: Discovery Questions

Record the technical questions to discuss with counsel when preparing discovery requests.

Editable CSV worksheet

Digital Forensics

Employee Departure: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Digital Forensics

Employee Departure: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

eDiscovery

Commercial Contract Evidence: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

eDiscovery

Commercial Contract Evidence: Discovery Questions

Record the technical questions to discuss with counsel when preparing discovery requests.

Editable CSV worksheet

eDiscovery

Commercial Contract Evidence: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

eDiscovery

Commercial Contract Evidence: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

Digital Forensics

Medical Matter Evidence: IT and System Owner Questions

Prepare the account, system access and ownership questions for IT and business staff.

Editable CSV worksheet

eDiscovery

Medical Matter Evidence: Discovery Questions

Record the technical questions to discuss with counsel when preparing discovery requests.

Editable CSV worksheet

Digital Forensics

Medical Matter Evidence: Open Questions

Track decisions and open questions in one place.

Editable CSV worksheet

Digital Forensics

Medical Matter Evidence: Evidence Index

List records and their sources so the team can locate the supporting evidence.

Editable CSV worksheet

All resources

Data Source Inventory

List systems, source records and accountable owners before deciding what to collect.

Editable CSV worksheet

All resources

Preparation Source Register

Locate the official and technical references supporting the preparation collection.

Editable CSV worksheet

Digital Forensics

Evidence Index Template

Create a consistent list of records, their sources and the people responsible for providing them.

Editable CSV worksheet

All resources

Engagement Intake Worksheet

Record the initial matter details and the questions to resolve before scoping the work.

Editable CSV worksheet

All resources

Preparation Handoff Checklist

Organize the records and decisions to pass to the next person responsible for the engagement.

Editable CSV worksheet

Digital Forensics

Prepare a Business Email Compromise Examination Pack

Gather the messages, account details, transaction records and incident timeline needed for a focused examination. Includes the supporting download files.

Downloadable resource pack

Digital Forensics

Prepare Computers for Evidence Preservation Pack

Record ownership, custody, access and preservation decisions before computers or storage media are handled for an examination. Includes the supporting download files.

Downloadable resource pack

OT and Critical Infrastructure

OT Workbook Guide

Read the instructions for using the editable planning records and interpreting the workbook fields.

PDF guide

OT and Critical Infrastructure

OT State Research Checklist

Compare the state and sector planning entries included in the OT assessment library.

Editable CSV worksheet

Digital Forensics

Prepare an Insider Activity Examination Pack

Coordinate devices, accounts, permissions and activity records before examining suspected misuse of business information. Includes the supporting download files.

Downloadable resource pack

Digital Forensics

Prepare Mobile Devices for Preservation Pack

Record device ownership, account details, access arrangements and handling decisions before an examiner collects mobile evidence. Includes the supporting download files.

Downloadable resource pack

Audit Preparation

New Jersey Utility Planning Manual

Organize the utility scope, planning references and evidence responsibilities for a focused technical review.

PDF guide

Audit Preparation

New Jersey Utility Planning Workbook

Organize the utility scope, planning references and evidence responsibilities for a focused technical review.

Editable Excel workbook

Audit Preparation

Preparation Checklist

Use this supporting reference to organize the preparation records and questions for your engagement.

Editable CSV worksheet

Audit Preparation

Preparation Questions Register

Track open questions, decisions and the person responsible for the next response.

Editable CSV worksheet

Audit Preparation

New York Utility Planning Manual

Organize the utility scope, planning references and evidence responsibilities for a focused technical review.

PDF guide

Audit Preparation

New York Utility Planning Workbook

Organize the utility scope, planning references and evidence responsibilities for a focused technical review.

Editable Excel workbook

Audit Preparation

Preparation Source Register

Locate the official and technical references supporting the preparation collection.

Editable CSV worksheet

OT and Critical Infrastructure

Preparation Checklist

Use this supporting reference to organize the preparation records and questions for your engagement.

Editable CSV worksheet

OT and Critical Infrastructure

Preparation Questions Register

Track open questions, decisions and the person responsible for the next response.

Editable CSV worksheet

OT and Critical Infrastructure

State and Local OT Research Companion

Use this supporting reference to organize the preparation records and questions for your engagement.

PDF guide

OT and Critical Infrastructure

OT Assessment Project Workbook

Use this supporting reference to organize the preparation records and questions for your engagement.

Editable Excel workbook

OT and Critical Infrastructure

Preparation Source Register

Locate the official and technical references supporting the preparation collection.

Editable CSV worksheet

OT and Critical Infrastructure

Organize OT Assessment Readiness Pack

Prepare inventories, operating boundaries, named decision makers and rules of engagement before an industrial security assessment. Includes the supporting download files.

Downloadable resource pack

Cybersecurity

Prepare for Penetration Testing Pack

See how we set the testing boundary, schedule, authorization, reporting requirements and follow up work with you for every test. Includes the supporting download files.

Downloadable resource pack

OT and Critical Infrastructure

Power OT and NERC CIP Scoping Pack

Use this supporting reference to organize the preparation records and questions for your engagement.

PDF guide

OT and Critical Infrastructure

Water SCADA and AWIA Planning Pack

Use this supporting reference to organize the preparation records and questions for your engagement.

PDF guide

Cybersecurity

Plan an AI Security Test

Review the scope, evidence and reproduction details used to examine prompt injection and data leakage in business AI systems.

PDF guide

Cybersecurity

Prepare an Application Security Assessment

Connect manual application testing, API review and source code analysis with the business systems and data at risk.

PDF guide

Expert Witness

Prepare Questioned Media for Examination

Understand the source files, metadata and examination methods used to assess disputed images, audio and video.

PDF guide

Cybersecurity

Respond to Business Email Compromise

Coordinate financial recall, account containment and preservation of the email and audit records needed for examination.

PDF guide

Cybersecurity

Plan PCI DSS Security Testing

Distinguish vulnerability scanning, penetration testing and segmentation review when preparing a payment security testing programme.

PDF guide

eDiscovery

Map Your Cloud Evidence Sources

Identify tenants, account owners, retention settings and available records before planning a cloud collection or examination.

PDF guide

Digital Forensics

Examine Suspected Corporate Espionage

Identify access records, file activity and other technical sources relevant to a suspected disclosure of business information.

PDF guide

Cybersecurity

Prepare Cybersecurity Due Diligence

Plan the technical questions, evidence requests and security assessments that inform an acquisition review.

PDF guide

Audit Preparation

Prepare Defense Contractor Cybersecurity Evidence

Review DFARS and CMMC evidence considerations, contractual responsibilities and the records a contractor should organize.

PDF guide

Digital Forensics

Document Digital Evidence for Litigation

Connect examination findings with original sources, authentication records and the methods supporting an expert opinion.

PDF guide

Digital Forensics

Plan Your First Forensic Examination

Understand how the question, data sources, scope and reporting requirements shape a forensic engagement.

PDF guide

Digital Forensics

Examine Deleted and Personal Account Email

Review the device, server and related artifact sources used to examine email activity and prepare preservation decisions.

PDF guide

Digital Forensics

Prepare Evidence After Payment Diversion

Organize bank contact records, relevant email and identity logs for a business email compromise examination.

PDF guide

Expert Witness

Document the Basis for Digital Expert Evidence

Prepare the methods, source records and examination documentation used by counsel when evaluating digital expert evidence.

PDF guide

Cybersecurity

Prepare Healthcare Ransomware Evidence

Coordinate clinical operations, incident records and access evidence during a healthcare ransomware response.

PDF guide

Cybersecurity

Review Personal Devices and Business Access

Examine device ownership, remote access and cloud activity when personal computers are used for company work.

PDF guide

Cybersecurity

Prepare a Law Firm Security Review

Identify the client data, access arrangements and technical assessment questions relevant to a legal practice.

PDF guide

Audit Preparation

Plan Required Cybersecurity Testing

Organize testing scope, scheduling, evidence and reporting against the frameworks applicable to your organization.

PDF guide

Digital Forensics

Review Mobile Location Evidence

Identify location sources, time settings and measurement conditions before interpreting records from a mobile device or provider.

PDF guide

Cybersecurity

Review Healthcare Phishing and Access Evidence

Connect email and identity activity with clinical systems, protected information and the questions a response team needs to address.

PDF guide

Audit Preparation

Organize SHIELD Act Incident Evidence

Gather access records, safeguard information and response decisions to support counsel reviewing a New York information incident.

PDF guide

Audit Preparation

Prepare Technical Records for Part 500 Review

Identify control evidence, security testing records and the relevant entity responsibilities for an NYDFS review.

PDF guide

OT and Critical Infrastructure

Prepare an OT Segmentation Review

Bring together network diagrams, firewall records and operational knowledge to plan a review of industrial network boundaries.

PDF guide

OT and Critical Infrastructure

Build an OT Asset Discovery Plan

Combine existing inventories, passive network evidence and engineering input to identify industrial systems and their owners.

PDF guide

eDiscovery

Preserve Teams, Slack and Email

Map retention settings, conversation context and administrative records before collecting workplace communications for litigation.

PDF guide

Cybersecurity

Preserve Evidence During Incident Response

Coordinate containment with collection of the device, identity and activity records needed to examine an incident.

PDF guide

OT and Critical Infrastructure

Scope OT Testing Around Operations

Agree the systems, approved methods, operating windows and stop conditions before industrial security testing begins.

PDF guide

Cybersecurity

Prepare Cybersecurity Risk Evidence

Connect technical assessments, incident facts and governance records when preparing a business cybersecurity review.

PDF guide

Cybersecurity

Examine Suspected Access Token Theft

Identify sign in, application and cloud activity records relevant to a suspected stolen session or access token.

PDF guide

All resources

Examine Suspected Intellectual Property Theft

Organize file activity, account access and device evidence when valuable business information may have left the organization.

PDF guide

Audit Preparation

NYDFS Cybersecurity Preparation Guide

Prepare the entity details, responsible staff and technical records for a financial services cybersecurity review.

PDF guide

Audit Preparation

New York Private Information Preparation Guide

Map private information, safeguards and record owners before a New York privacy review.

PDF guide

Cybersecurity

Defense Contractor Cybersecurity Preparation Guide

Organize contract scope, information systems and cybersecurity evidence for a defense contractor review.

PDF guide

Audit Preparation

Export Control Evidence Preparation Guide

Identify the information, access arrangements and questions counsel needs to scope an export control evidence review.

PDF guide

Digital Forensics

Employee Departure Preparation Guide

Identify devices, accounts, custodians and business records before routine employee offboarding changes them.

PDF guide

eDiscovery

Commercial Contract Evidence Preparation Guide

Organize the systems, communications and questions relevant to a commercial contract matter.

PDF guide

Digital Forensics

Medical Matter Evidence Preparation Guide

Identify the devices, accounts, records and responsible staff involved in a medical evidence matter.

PDF guide

All resources

Map the Records Relevant to Your Matter

Identify systems, account owners and the records to discuss with counsel, IT and your examination team.

PDF guide

All resources

Find the Preparation Library Sources

Use the source register to locate the official and technical references supporting the preparation packages.

PDF guide

Cybersecurity

Prepare a Business Email Compromise Examination

Gather the messages, account details, transaction records and incident timeline needed for a focused examination.

PDF guide

Digital Forensics

Preserve Digital Evidence Before Examination

Review the device, account and handling decisions that should be coordinated before records are collected or systems are changed.

PDF guide

All resources

Cybercrime Terms for Legal and Business Teams

A reference to the language used in cyber incidents and digital examinations, for teams preparing questions and reviewing findings.

PDF guide

Cybersecurity

Cybersecurity Acronym Reference

Look up the abbreviations used in security discussions, technical reports and assessment planning.

PDF guide

Cybersecurity

Digital Forensics and Cybersecurity Glossary

A practical terminology reference for counsel, executives and technical staff working with digital evidence and security findings.

PDF guide

Digital Forensics

Plan Your First Forensic Examination

Understand how the question, data sources, scope and reporting requirements shape a forensic engagement.

PDF guide

Digital Forensics

Understand the Forensic Examination Process

Follow the work from preservation and collection through analysis, reporting and preparation for testimony.

PDF guide

Audit Preparation

Organize Your Audit Preparation

Choose the relevant preparation track and organize evidence requests, responsible staff and questions for your review team.

PDF guide

Digital Forensics

Prepare an Insider Activity Examination

Coordinate devices, accounts, permissions and activity records before examining suspected misuse of business information.

PDF guide

OT and Critical Infrastructure

Manufacturing Assessment Planning Manual

Organize the operating scope, evidence requests, responsibilities and sector references for an assessment planning discussion.

PDF guide

OT and Critical Infrastructure

Maritime Assessment Reporting Guide

Define the system maps, evidence records, corrective actions and reporting outputs to agree with an assessment team.

PDF guide

OT and Critical Infrastructure

Maritime Assessment Preparation

Gather system details, accountable staff and operating constraints before discussing the scope of an assessment.

PDF guide

Digital Forensics

Plan Secure Equipment Retirement

Prepare retention decisions, sanitization methods, verification records and approvals before equipment is reused or retired.

PDF guide

Audit Preparation

New York Utility Assessment Planning Manual

Organize the operating scope, evidence requests, responsibilities and sector references for an assessment planning discussion.

PDF guide

Audit Preparation

New York Utility Audit Questions for Counsel

Coverage, timing and adopted text questions to settle under PSC Part 1200, DFS Part 500 and New York breach law before a utility audit.

Web page

Read the questions

OT and Critical Infrastructure

Review OT Backup and Recovery Readiness

Check configuration backups, restore responsibilities and recovery exercises for the systems your operations depend on.

PDF guide

OT and Critical Infrastructure

OT Questions to Settle Before Field Work

What the OT planning set covers and the rule and facility questions to answer with counsel before an assessment is scheduled.

Web page

Read the questions

OT and Critical Infrastructure

Organize OT Assessment Readiness

Prepare inventories, operating boundaries, named decision makers and rules of engagement before an industrial security assessment.

PDF guide

OT and Critical Infrastructure

Find State and Local OT Planning References

Use the fifty state research profiles to organize jurisdiction specific questions and locate the relevant planning references.

PDF guide

Cybersecurity

Prepare for Penetration Testing

See how we set the testing boundary, schedule, authorization, reporting requirements and follow up work with you for every test.

PDF guide

OT and Critical Infrastructure

Power and Energy Assessment Reporting Guide

Define the system maps, evidence records, corrective actions and reporting outputs to agree with an assessment team.

PDF guide

OT and Critical Infrastructure

Power and Energy Assessment Planning Manual

Organize the operating scope, evidence requests, responsibilities and sector references for an assessment planning discussion.

PDF guide

OT and Critical Infrastructure

Power and Energy Assessment Preparation

Gather system details, accountable staff and operating constraints before discussing the scope of an assessment.

PDF guide

OT and Critical Infrastructure

Transportation Assessment Planning Manual

Organize the operating scope, evidence requests, responsibilities and sector references for an assessment planning discussion.

PDF guide

OT and Critical Infrastructure

Review Water System Remote Access

Inventory remote connections, account ownership, access approval and monitoring records for a water or wastewater utility.

PDF guide

OT and Critical Infrastructure

Water and Wastewater Assessment Reporting Guide

Define the system maps, evidence records, corrective actions and reporting outputs to agree with an assessment team.

PDF guide

OT and Critical Infrastructure

Water and Wastewater Assessment Planning Manual

Organize the operating scope, evidence requests, responsibilities and sector references for an assessment planning discussion.

PDF guide

OT and Critical Infrastructure

Water and Wastewater Assessment Preparation

Gather system details, accountable staff and operating constraints before discussing the scope of an assessment.

PDF guide