Understanding how to gather and analyze digital evidence to identify the root cause of a security incident.