Examining the state of preparedness of Information Technology management in New Zealand for events that may require forensic analysis

KEYWORDS Security policy; Forensic policy; IT management; Forensic readiness; Statistics Computer security is of concern to those in IT (Information Technology) and forensic readiness (being prepared to deal effectively with events that may require forensic investigation) is a growing issue. Data held only on magnetic or other transient media require expert knowledge and special procedures to preserve and present it as valid in a criminal or employment court. Staff required to handle possible forensic evidence should be forensically knowledgeable. Having policies and procedures in place is one inexpensive way to protect the forensic data and can mean the difference between a valid case and no case. This paper presents the results of a survey of IT managers in New Zealand (NZ) examining the state of awareness of IT management in NZ regarding the field of digital forensics in general and their state of preparation for protection of forensic data in the case of an event requiring forensic analysis. Introduction Computer security is of concern to those in IT (Information Technology) and forensic readiness (cost effectively maximising the potential to use digital evidence when required) is a growing issue (Rowlingson, 2003). Electronic evidence is easily overwritten and lost. Data held only on magnetic or other transient media require expert knowledge and special procedures to preserve and present it as valid in a criminal or employment court. Anyone