Digital forensics and investigation data sources

3 quick checks≈2% of the testStretch

Reading is free. Sign in to tick off lessons, keep your place and track your mastery.

By the end you’ll be able to

Apply forensic principles: legal hold, chain of custody, acquisition by order of volatility, preservation, e-discovery and reporting
Choose the log source that answers an investigation question: firewall, application, endpoint, OS security, IDS/IPS, network, authentication logs and metadata
Use data sources: vulnerability scans, automated reports, dashboards, packet captures, NetFlow/IPFIX and surveillance footage

0% read

Parse and correlate logs to build an incident timeline

This lesson hasn’t been written yet

Security+ lessons are written from the official syllabus the first time a learner opens them, then saved for everyone. Sign in and this one is written for you in a minute or two. It’s free.

Sign in Create a free account