← Home Forensic Process
—Round
0Score

FORENSIC PROCESS

Choose a framework — sort forensic activities into the correct phases.

NIST SP 800-86
4-Phase Model
1Collection
2Examination
3Analysis
4Reporting
Trap: Examination ≠ Analysis
ISC2 CBK — Domain 7
7-Phase Model
1Identification
2Preservation
3Collection
4Examination
5Analysis
6Presentation
7Decision

Sources: NIST SP 800-86  ·  ISC2 CBK Domain 7

Drag each activity to the correct phase — or tap an activity then tap a lane.
Activities to sort

Phase Rationale

Drill Complete

← Home

Not affiliated with, endorsed by, or sponsored by ISC2®. CISSP is a registered trademark of ISC2.