processes for collecting, packaging, transporting, and storing electronic evidence while maintaining chain of custody. cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation,...