Question 109
Main Page
Which phase of digital forensics focuses on understanding what happened, when, and by whom?
A. Collection
B. Analysis
C. Reporting
D. Preservation
Answer: Analysis
The analysis phase interprets evidence to reconstruct attacker actions and impact.