SANS Incident Handler's Handbook and PICERL Methodology
Identification

SANS Incident Handler's Handbook and PICERL Methodology PICERL-I-03: Identification: Evidence Collection and Chain of Custody

Collect and preserve evidence following forensic principles including write protection, hashing, documentation of acquisition, and maintenance of chain of custody for potential legal proceedings.

Other controls in Identification

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls