Technical and organizational preparations required to be optimally prepared for a forensic investigation of security incidents. Typical aspects are: Definition of the IT security organization (internal and external), logging type and depth, tool selection, training of involved staff and emergency drills.