File forensics is important because an attacker may leave behind traces, and the evidence needs to be gathered before any more changes are made or any information is lost. This includes determining who owns a file, when it was last changed, who has access to it, and seeing whether there is any hidden data in a file.
Files
Get Security with Go now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
