I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are:

  1. Response
  2. Triage
  3. Investigation
  4. Containment
  5. Analysis and tracking
  6. Recovery
  7. Repair
  8. Debriefing and feedback

I can't understand the difference between Investigation phase and Analysis and Tracking phase. Both refer to analyzing and dissecting the collected evidence in-house or with external experts.

Any help?


1 Answer 1


The short version is that investigation is gathering information, and analysis is putting information (gathered from the investigation) into a comprehensive picture.

The ECcouncil (CEH governing body) says

Computer hacking forensic investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks.

After this information is obtained, an analysis can be made about the information. An analysis might include the risk of a repeat attack, what information was taken, other vulnerable systems that might also be exploited, what was the attacker searching for, etc.

  • New account. Not enough reputation :(
    – Alien Fan
    Commented May 31, 2018 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .