Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK], Foremost).
Core KSAT for the following Work Roles
No Work Roles with Core KSAT 868
Additional KSAT for the following Work Roles
Conducts deep-dive investigations on computer-based crimes establishing documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents.