Lesson 2 of 12 · Fundamentals
Collecting evidence: order of volatility and chain of custody
Objective
Gather everything on a suspect server that can help the investigation, in the right order, changing the machine as little as possible, and be able to prove later that nothing was altered.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.