A solid toolset is at the core of any s uccessful digital forensics program. SANS Investigative Forensic Toolkit (SIFT) is a suite of more than a dozen different tools. Disk imaging tools are useful to preserve the state of a PC or a phone before you begin any examination. Forensic examiners create image copies so they dont have to worry about damaging the file system as they perform their analysis. The first step is to examine what is going on your network so you can analyze what is happening.”]
Source: https://www.csoonline.com/article/3333650/building-your-forensic-analysis-toolset.html