Forensic Investigations

Forensic investigations can help to determine what information was stored on a computer, if a data breach has occurred, and what information may have been shared. This information is vital in determining the next best steps in the case of a serious data breach. A written authorization must be issued by University Counsel for any forensic investigation can proceed.

Benefits of this investigation include:

  • Helps ascertain, to the extent feasible, whether personal information was exported from a device
  • Determines University liability and action under applicable laws

If there is an incident which you believe may warrant a forensic investigation, please follow the Personal Information Incident Response Workflow and the Incident Reporting's Four Questions to determine the best course of action. Contact the TTS Service Desk, your Information Steward, or Information Security and notify them of the incident.