In order to successfully prosecute an intruder:
a.A point of contact should be designated to be responsible for communicating with law enforcement and other external agencies
b.Collection of evidence has to be done following predefined procedures
c.A proper chain of custody of evidence has to be preserved
d.To avoid inadvertently tamping with evidence, a replica of the compromised resource should be analyzed rather than the original.