What is a Forensic Examination

• A formal documented examination

• Intent is for public presentation versus private

• Detective vs Systems Administrator mindset

• A verifiable analysis of a chain of events

• Produces a set of documents and evidence

• Purpose goes beyond "fixing" the problem

Notes: