Digital forensics
Also called: computer forensics
The scientific identification, collection, examination and analysis of data from computers, phones and networks while preserving its integrity, used to reconstruct what an attacker did. When you suspect an intrusion, preserve memory and logs before reimaging anything; otherwise you may never learn how the attacker got in or what data left.
Further reading: csrc.nist.gov
From the Security Academy
The First 24 Hours of a Suspected Breach: What to Do and What to Avoid
Suspect an intrusion? Scope it, preserve evidence, then contain and reset credentials. A first-day plan from NIST and CISA guidance, plus Taiwan reporting.
10 min read ·
Advisories that mention this term
Weizhi Technology (4953) found abnormal access to internal systems; some employee and work contact data may have been exposed
According to iThome, on October 9, IT services company Wistron ITS (4953) issued a material announcement on the Market Observation Post System (MOPS), stating that it detected abnormal access to internal systems on October 8 and confirmed through investigation that partial employee information and business contact details may have been exposed .