ISC2 · CISSP
Investigations and forensics
CISSP · Lesson 26 of 34 · 3:21:27
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISC2 CISSP exam, on the 2027 outline. In this lesson: evidence collection and handling, the chain of custody, the order of volatility, digital forensics with forensic images and write blockers, data, computer, network, and mobile artifacts, investigative techniques, and reporting. Includes three original practice questions.
Preview the topics
- Investigators arrive at a running server that may hold malware in memory. What should they capture first?
- Which document shows every person who handled a seized laptop, and when?
- An examiner must image a suspect’s drive without changing a single bit on it. What should the examiner use?