Digital Forensics and Incident Response - Second Edition

Sources

When preparing reports, there are several sources of data that are included within the documentation, whether the incident is small, requiring only a single entry into a ticketing system, all the way to a complex data breach that requires extensive incident and forensic reporting. Some sources include the following:

• Personal observations: Users may have some information that is pertinent to the case. For example, they might have clicked on a file in an email that appeared to come from a legitimate address. Other times, analysts may observe behavior in a system and make a note of it.
• Applications: Some applications produce log files or other data that it may be necessary to include in a report.
• Network/host devices: A great deal of ...