This document is intended to help organizations in handling computer security incidents. It also provides some practical guidance on performing computer and network forensics. SP 800-86 describes the processes for performing effective forensics activities in support of incident response, and it provides advice regarding different data sources, including files, operating systems, network traffic, and applications.

Download the entire NIST SP 800-86 Document.

You may use the NIST.org Forum to ask questions or discuss this document.

Below is a short description of SP 800-86 from NIST.gov, edited:

NIST.gov has released the final of SP 800-86, "Guide to Integrating Forensic Techniques into Incident Response". This document is intended to help organizations in handling computer security incidents. It also provides some practical guidance on performing computer and network forensics. SP 800-86 describes the processes for performing effective forensics activities in support of incident response, and it provides advice regarding different data sources, including files, operating systems, network traffic, and applications. Several scenarios involving the use of forensic techniques are also included as the basis for tabletop exercises.

Forensic science is generally defined as the application of science to the law. Digital forensics, also known as computer and network forensics, has many definitions. Generally, it is considered the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data. Data refers to distinct pieces of digital information that have been formatted in a specific way. Organizations have an ever-increasing amount of data from many sources. For example, data can be stored or transferred by standard computer systems, networking equipment, computing peripherals, personal digital assistants (PDA), consumer electronic devices, and various types of media, among other sources.

Because of the variety of data sources, digital forensic techniques can be used for many purposes, such as investigating crimes and internal policy violations, reconstructing computer security incidents, troubleshooting operational problems, and recovering from accidental system damage. Practically every organization needs to have the capability to perform digital forensics. This guide provides detailed information on establishing a forensic capability, including the development of policies and procedures. Its focus is primarily on using forensic techniques to assist with computer security incident response, but much of the material is also applicable to other situations.

---
The SP 800-86 document was created by the National Institute of Standards and Technology and is public domain (not subject to copyright).