Domain 7 · Objective reference 7.1 · Chapter 43 of 62
Support investigations and evidence handling
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Document who handled what when and why.
Explore the anchors
Prevent avoidable evidence alteration.
Concept matching activity
Match this task or description to its concept:
Record acquisition possession and transfers.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Investigation combines a question, authorized scope, collection, analysis, documentation and reporting. Artifacts can come from hosts, applications, networks, cloud services and mobile devices. Record source, method, time and handler. Integrity checks support detecting changes; custody records trace handling. Neither makes an inaccurate source accurate or substitutes for authority to collect it.
Design, evidence and tradeoffs
Preserve relevant volatile or short-retention evidence where feasible, while coordinating urgent harm-limiting actions through delegated authority. Protect privacy and avoid unrelated collection. Forensic tools and specialist methods require competence and validation. Separate facts, hypotheses and confidence, and retain the original evidence appropriate to the investigation purpose and obligations.
Worked example
An incident team records the log source and extraction conditions instead of saving only a screenshot of a tool’s summary.
Check your understanding
Why is a file hash insufficient documentation by itself?
Show explanation
It helps verify a particular artifact but does not explain provenance, collection authority, timing or handling.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.