Guide to Integrating Forensic Techniques into Incident Response
National Institute of Standards and Technology
A practical forensics manual built on a four phase process of collection, examination, analysis and reporting, applied to data files, operating systems, network traffic and applications. It also covers evidence integrity, tool selection and the policy questions that need answers before an incident starts.
Loading the book...
Keep reading
-
Next in this topic
Incident Response Recommendations for Cybersecurity Risk ManagementA modern take on incident handling that treats response as part of continuous risk management rather than a separate playbook. It maps the work onto the six framework functions and lists the outcomes an organization should be able to demonstrate before, during and after an incident.
Verified PDF · Secure download - Guide for Cybersecurity Event Recovery
What to do after containment: planning recovery, defining processes and criteria, measuring how recovery is going, and running the exercises that make a plan hold up under pressure. Includes one worked scenario for ransomware and one for data integrity loss.
Verified PDF · Secure download - Guide to Malware Incident Prevention and Handling
Covers the categories of malware and the attacker tools that come with them, the layered defenses that reduce exposure, and the handling process once something gets through, from detection and containment to eradication and recovery.
Verified PDF · Secure download - StopRansomware Guide
A joint advisory in two parts: the prevention practices that close the initial access routes ransomware relies on, and a response checklist for the first hours of an incident, covering detection, isolation, reporting, and why paying the ransom rarely works.
Verified PDF · Secure download - ENISA Threat Landscape 2025
An annual assessment of what is actually happening in attacks: the prime threat categories, the sectors being targeted, the techniques observed in the wild, and the trends behind them. Useful when you need evidence rather than anecdotes to argue for a security investment.
Verified PDF · Secure download
