Summary

In this chapter, we learned the importance of first response procedures when addressing a cybersecurity incident. We also reviewed the concept of chain of custody and prioritizing the acquisition of evidence based on the order of volatility.

We also learned about the concept of triage and the different tools we can use to collect evidence from forensic artifacts.

In the next chapter, we will apply the concepts learned in the first three chapters to work on practical labs based on scenarios.