868

May 21, 2020
KSATs
868 (NIST ID: T0238)

Task

Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK], Foremost).
Items denoted by a * are CORE KSATs for every Work Role, while other CORE KSATs vary by Work Role.

Core KSAT for the following Work Roles

No Work Roles with Core KSAT 868

Additional KSAT for the following Work Roles

Forensics Analyst (Additional) ID: 211 (NIST ID: IN-FO-001) Workforce Element: Cyberspace Enablers / Legal/Law Enforcement

Conducts deep-dive investigations on computer-based crimes establishing documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents.
Host Analyst (Additional) ID: 463 (NIST ID: N/A) Workforce Element: Cyberspace Effects

A Host Analyst (HA) will have knowledge of various system configurations encountered. This work role also performs analysis using built-in tools and capabilities. A Host Analyst will have knowledge of system services and the security and configuration of them, as well as knowledge of file systems, permissions, and operation system configurations. The Host Analyst conducts analysis using built-in tools and capabilities.