Digital forensics
forensics · DFIR · digital forensics and incident response · computer forensics · forensic investigation · post-mortem analysis · forensique
The discipline of collecting, preserving and analysing digital traces (disks, memory, logs) to reconstruct what happened during an incident, rigorously enough for the evidence to stand up in court.
In practice
Investigators start by freezing the evidence: exact copies of disks, memory captures, preserved logs, with every handling step documented (chain of custody). The analysis then establishes the entry point, the timeline, the accounts and machines affected, and the data exfiltrated. DFIR (Digital Forensics and Incident Response) ties this investigation to incident response: without it, eradication is guesswork and the attacker comes back. In France, ANSSI qualifies incident response providers (PRIS) able to carry out such investigations.
Fictional case: after a ransomware attack, analysis of the VPN logs shows the attacker got in six weeks earlier with a stolen password, on an account without MFA. Without that finding, the company would have restored its systems and left the front door wide open.
