Don’t Let Legacy Media Foil Your Forensic Investigation

When performing incident response and forensics on a compromised system, the focus of analysis is on the most immediately available and relevant sources of evidence. Volatile data collected from a running system, the hard drive, network flow data, and logs collected on a central server all serve as useful sources for determining the particulars of the incidents. But what about incidents that go back further, requiring you to dig into backup tapes – and potentially very old ones?

More (Dark Reading)

Leave a Comment