Once a cybersecurity incident has occurred, it must be investigated and reported so that an organization can learn from the incident. This course discusses the various types of evidence, how to analyze that evidence, and when to involve law enforcement. This course includes low-leveldevice analysis including filesystems, flash memory, and mobile devices. The concepts of chain of custody and the protection of evidence while performing effective forensics are covered.