Conducting an investigation

In this section, we will look at guidelines contained in NIST.SP800-86. This will develop on the techniques and principles that were described in Chapter 3, Computer Forensics and Evidence Handling, placing the theory in the context of the industry guidance. This will cover topic 5.4a-d, thus completing the Cisco 210-255 specification:

Implementing Cisco Cybersecurity Operations (210-255) Topic List:

5.4 Describe these concepts as they are documented in NIST.SP800-86
5.4.a Evidence collection order
5.4.b Data integrity
5.4.c Data preservation
5.4.d Volatile data collection

In this section, it will be worth cross-referencing with Chapter 3, Computer Forensics and Evidence Handling, so that the guidance is viewed in concert with the overall theory.

Evidential...