Your forensics has provided the initial response detailing the meaning behind the cyber-terrorism case and the different types of evidence associated. In the preliminary investigative discussion your POC for the cyber-terrorism case would like for your team to disclose in your Forensics Plan how you will approach the incident review, to include the identification of any collection requirements for acquiring and authenticating the evidence. To ensure your team is operating legally in the investigation the POC has requested also in the Forensics Plan how your team will approach any legal restrictions and the determination of intent and scope. You will provide the POC additionally as a matter of procedure the known facts of the incident and what procedures were used during the initial case reviews.
How will you approach the incident review, to include the identification of any collection requirements for acquiring and authenticating the evidence?