Interviewing Witnesses – CompTIA Security+ SY0-401: 2.4


There’s sometimes no replacement for having a first-hand account of an incident. In this video, you’ll learn the advantages and disadvantages of interviewing witnesses.

<< Previous Video: Taking ScreenshotsNext: Tracking Man-Hours and Expenses >>


A useful non-digital source of information is witnesses– finding people who have seen something going on. They saw a co-worker acting peculiar. Maybe they saw someone walk in the front door that they didn’t recognize. And you want to find out more about what they may have seen. So document, talk to them, call them, write down what they’ve seen, gather information about what they happen to have identified that day. And try to get very quickly to that person. The more time goes by, the more we tend to forget. So you want to get something that’s very top of mind, very fresh in their memory.

Now keep in mind of course, that witnesses are not 100% accurate. They’re giving you an idea of what they think they saw. Sometimes what we think we see is not actually what occurred. But in our mind, that’s absolutely what happened, even if it isn’t. So although the information they’re giving you they may feel is absolutely 100% accurate, you should always find ways to get a second party to verify what they’re doing. Or in some way try to figure out what they’re saying, and try to put it in context of what actually occurred.