Exam CS0-001 topic 1 question 51 discussion

"The Forensic Analysis step during IR is a process of analyzing and reviewing gathered data from different sources e.g. computer, log files, web history, email files, pictures & information for users using tools to gather info such a asset IDs, serial numbers, arrival and depature times, transport routing #, name/tile handlers and location. Forensic Analysis should also help determine victims/attackers, the what, who and where, and how the incident was done. Forensic Analysis enable us to go through and create a case against the attacker during the investigation process." Dale Meredith Performing Incident Response and Handling (Pluiralsight course)

I think the answer is lesson learned simply because a forensic report focuses on reporting evidence and steps taken to collect those evidence and it is for legal purposes. It shouldn't have information about the impact of the incident nor how it was remediated.