 Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others

NIST SP800-86, August2006, DOI10.6028/NIST.SP.800-86; first author Karen Kent verified on official record csrc.nist.gov/pubs/sp/800/86/final . Section2.1, printedp.2-2, and section3 describe collection, examination, analysis and reporting; section3.1 addresses data integrity and section3.3 interpretation/correlation. Primary institutional guide concerns incident response and troubleshooting, not only criminal proceedings. Clock-offset example is independently stipulated, not an incident reconstructed from the guide.