Alex, an attacker, successfully acquired access credentials for an internal server system within an organization. Alex, logging in at unconventional hours, consistently monitored network activities. Due to suspicions regarding the irregular login times, the organization enlisted cybersecurity expert Oliver to investigate the matter. Oliver conducted a thorough analysis of the compromised device, extracting details about the incident, including the nature of the attack, its severity, target, impact, propagation method, and the vulnerabilities exploited. What specific phase of Incident Handling and Response (IH&R) does Oliver's investigation fall under?