Glossary: Security Operations and Incident Response
Investigation
The stage of working out what happened (how the attacker got in, what they did and touched, and whether they are still there) while protecting the evidence.
Where the book teaches it
Related terms
Digital forensicsChain of custodyE-discovery (electronic discovery)Preservation