Incident Response

The Decision-Context Pack: What to Capture Before Something Breaks

An investigation can only use what existed before it started. The way to know what to keep is to run the investigation backwards.