After evidence is acquired, it has to be analyzed. CySA+ expects you to know what the common free and open-source forensic tools do and what kinds of findings they produce, rather than every command option. The three named in this objective cover different jobs: Volatility analyzes memory captures, FTK Imager acquires and previews images, and Autopsy analyzes disk images in depth.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.