I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are:
- Analysis and tracking
- Debriefing and feedback
I can't understand the difference between Investigation phase and Analysis and Tracking phase. Both refer to analyzing and dissecting the collected evidence in-house or with external experts.