Describe your plan for processing the potential crime/incident scene. Some of the items you will want to cover include (not all inclusive):

How will your team identify potential digital evidence?

How will you prepare for the search?

What steps will your team take if you need to seize any digital evidence?

What documentation processes will you follow to help support any potential legal proceedings?

How will your team/company ensure proper storage/chain of evidence processes are followed?

Discuss how your team will approach and process the database administrator's computer -- considering the potential malware on her system. 

Include the steps you will use to image her drive.

The areas on her system you will analyze for potential evidence of infection and/or modification.Other items.

Discuss how your team will approach and process the database server -- as this is the location for patient medical records. 

Include the steps you will use to image the server's hard drive.

The areas on the server's system you will analyze for potential evidence of infection and/or modification.Other items.

Discuss how you prepare your team to be expert witnesses or support any expert testimony court requirements. 

Include the steps you take in the documentation phases of your investigation.