Digital forensics is the work of collecting and examining data from computers, phones, servers, cloud accounts and backups, to reconstruct exactly what happened during an attack. When it is done by a company's security team right after an attack, it is often called DFIR, short for digital forensics and incident response. The police use the same methods in criminal cases.
Digital forensics starts after the attack has been stopped. The security operations centre (SOC) has shut the attacker out. Now the company has harder questions to answer. How did the attacker get in? What did they touch? Which customer records left the company? Is the attacker still inside somewhere?
Forensics tools first make a copy of the evidence. They copy the full disk of a laptop, the memory of a running server, or the activity records of a cloud account. The copy is checked with a hash, a short code calculated from the data. If even one byte of the data changes, the hash changes. So the hash proves later that nobody altered the evidence. Investigators then work only on the copy. Some tools collect the data remotely, from machines that cannot be brought to a lab, such as a server in another city.
Then investigators build a timeline. Consider a textile exporter in Coimbatore whose new designs appear on a competitor's website before the launch. Investigators copy the disk of a designer's laptop. The copy shows that a harmful program was installed from a fake invoice email twelve days earlier. The SIEM logs show that the program connected to an address abroad every night after that. The records of the network detection and response (NDR) tool show that 8 GB of design files left over five nights.
After a ransomware attack, forensics also checks the backups, to find the last copy that the attacker had not touched. The findings go into the final report in the incident response workspace. They also go to regulators and lawyers when needed.