I was just wondering if anyone had any suggestions or knew of a list of potentially useful questions to ask while on a search of a small business with a simple LAN setup?
This is aimed mostly at content (e.g. financial documents) related searches, not incident response.
I'm trying to put together a resource to help remind investigators of the questions they should think about asking. Questions about things like passwords, logging, storage, user restrictions, placing users at the keyboard, etc.
You may also want to ask for backups (e.g. mail backups, file backups, etc). Some small business may not have servers in their own location but there might be servers on some other hosting environment.
They may also use outsourced IT service providers who knows every single details about your target's IT infrastructure.
Cheers,
Cypri