23. Digital forensics without destroying evidence
Preserve evidence, keep chain of custody, image disks, collect memory, review timelines, and recover deleted or hidden artifacts. You will know how investigations differ from ordinary troubleshooting.