Immediate Actions
Assign a technician and responsible person to report to Computer Crime Section
Reproduce the computer logs from the cloned working copy of harddisk
Preserve the incriminating harddisk for Police exhibit
Assist Police in tracing the logs for responsible attacker