Summary

During the course of this chapter, you have learned about the need for computer forensics to determine the intention of an attacker, who the attacker is, and which resources were compromised. Additionally, you have learned about the various stages of a digital forensic investigation, the importance of maintaining a proper chain of custody, and the order of volatile data on a system. Furthermore, you have gained the skills to create a forensically sound disk image on both Windows and Linux operating systems, using various tools to check whether the compromised data was tampered with in any way. Lastly, you have understood the role of attribution during a forensic investigation.

I hope this chapter has been informative for you and is helpful in your journey toward learning the foundations of cybersecurity operations and gaining your Cisco Certified CyberOps Associate certification. In the next chapter, you will learn how to perform network intrusion analysis using various...