Which incident handling phase contains evidence gathering and handling?

Containment, eradication, and recovery focuses on stopping the threat, removing malicious artifacts, and restoring normal operations - not formal evidence collection and handling.

Identification involves detecting and confirming that an incident has occurred, not formally gathering and preserving evidence for forensic or legal purposes.

The post-incident phase encompasses activities performed after an incident is resolved, including formal evidence gathering, chain-of-custody handling, and retention to preserve forensic integrity. Per NIST SP 800-61r2, this phase includes using collected incident data and retaining evidence according to legal and policy requirements. Proper evidence handling at this stage ensures admissibility and supports future investigations or legal proceedings.

Preparation involves establishing policies, tools, and response procedures before an incident occurs, not collecting or handling evidence.