In order to be able to successfully prosecute an intruder:

A.
A point of contact should be designated to be responsible for communicating with law
enforcement and other external agencies.

B.
A proper chain of custody of evidence has to be preserved

C.
Collection of evidence has to be done following predefined procedures

D.
Whenever possible, analyze, a replica of the compromised resource, not the original, thereby
avoiding inadvertently tampering with evidence