SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-forensic-phases-sp800-86

In NIST SP 800-86's forensic process, which phase comes right after collection?

Examination, then analysis and reporting.

Start playing free

  1. Examination ✔
  2. Analysis
  3. Reporting

Why: NIST lists four phases: collection, examination, analysis and reporting. Collection gathers and preserves data. Examination uses tools to extract relevant information while protecting integrity.

Huh, didn't know that: The final phase, reporting, may include recommending improvements to policies and procedures.

The dad joke
The forensic process is like a recipe: collect the ingredients, examine them, analyze the mess, then report the burnt parts.
Like this card?
Play the game

References

Answer: Examination. NIST lists four phases: collection, examination, analysis and reporting. Collection gathers and preserves data. Examination uses tools to extract relevant information while protecting integrity.

  1. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
    basic phases of the forensic process: collection, examination, analysis, and reporting
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyUnder NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?Security & PrivacyWhat does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?Security & PrivacyA legacy device can no longer be patched because the vendor ended support. What does NIST SP 800-40r4 suggest?

That's stuff everyone should know.