Evidence Preservation and Post-Incident Review Audit
Check records of how an incident was handled.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Review a past incident. Incident timeline and actions: [INCIDENT_TIMELINE]. Records kept: [RECORDS_KEPT]. Who was told and when: [NOTIFICATIONS]. Check whether evidence was preserved before systems were changed, whether decisions were logged, whether notification duties were considered, and whether actions from the review were completed. Calculate time to detect, contain and recover from the timeline. Return a table of gaps, the arithmetic for each time, and an improved record template. Legal and regulatory duties require professional advice [VERIFY]. Add a worked timeline calculation: first malicious activity estimated 02:00; detected 09:15; contained 10:30; recovered 17:00. Time to detect = 7 hours 15 minutes; to contain = 1 hour 15 minutes after detection; to recover = 6 hours 30 minutes after containment. Total from first activity to recovery = 15 hours. Gaps found: evidence on one machine was overwritten when it was rebuilt before copies were taken. Add a template to record decisions with times and who made them.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.