Note to self:

Check SANS!

http://www.sans.org/rr/whitepapers/incident/

Another one if any is looking:

http://www.forensicfocus.com/chain-of-evidence-model