Video Description

This lesson covers the keys to preservation. In order to keep evidence clean and accurate, it is important investigators not tamper or alter any evidence. In addition, it is important to remember that evidence goes beyond computers and could also include devices such as IDS, routers, firewalls, sniffers or other devices. Finally, evidence must be collected in the order of volatility, which basically means the order that evidence that will change once power is shut off. Volatile evidence provides the strongest information about an incident.

Course Modules

Incident Response & Advanced Forensics