Digital forensics and incident response

Incident response asks "how do we stop this and recover?". Digital forensics asks "what exactly happened, and can we prove it?". DFIR brings the two together, because answering the second question well is what makes the first one reliable: you cannot be sure an attacker is gone if you do not know how they got in and what they touched.

Forensic work follows a few principles. Collect the most volatile evidence first, such as memory and live network connections, before it disappears. Preserve evidence without altering it, and record hashes to prove it was not changed later. Keep a chain of custody documenting who handled each piece of evidence and when. NIST SP 800-86 describes how to integrate these techniques into the incident response process.

Example

Before rebooting a server suspected of running ransomware staging tools, the team captures its memory and a disk image, records SHA-256 hashes of both, and only then isolates it. Analysis of the memory image later reveals the attacker's command-and-control address, which leads them to two other compromised hosts that had not raised any alert.

Why it matters for a SOC analyst

Many first responders accidentally destroy evidence by rebooting, reimaging or "cleaning" a machine too early. Knowing when to pause and preserve evidence, and when speed matters more, is a core DFIR skill. Tools such as EDR live response, KAPE and Velociraptor make triage collection fast enough that it rarely needs to slow containment down.