Definition
Cyber Investigation refers to the systematic process of gathering, analyzing, and preserving digital evidence to understand and respond to security incidents. This involves identifying the scope of a breach, tracing the attacker's actions, and determining the impact on systems and data. It is crucial for incident response, legal proceedings, and improving future security postures. For example, a cyber investigation might track how malware infiltrated a network by examining log files and system artifacts. This differs from merely detecting an intrusion, as investigation focuses on reconstructing the entire event. Understanding cyber investigation is vital for roles covered by CompTIA CySA+ and other cybersecurity certifications.