Cybersecurity glossary
What is Forensic Analysis?
Learn what forensic analysis is, how digital evidence is preserved and examined, how timelines are built after an incident, and how forensics supports containment, legal, and lessons-learned work.
Definition
Forensic analysis is the methodical collection, preservation, and examination of digital evidence—hosts, memory, logs, cloud artifacts, and communications—to reconstruct what happened, attribute actions where possible, and support incident response, legal, or disciplinary outcomes.
Why “just reimage it” can make the next breach worse
Wiping a laptop stops that host. It also erases the only copy of how the attacker entered, what they stole, and which sibling systems still hold persistence. Forensic analysis is the discipline of answering those questions with evidence you can still trust tomorrow.
Speed and preservation are in tension. Mature IR teams plan both before the first isolate click.
Evidence sources that actually reconstruct incidents
Host and memory
Disk images, volume snapshots, RAM, prefetch, and execution artifacts that logs never recorded.
Endpoint telemetry
EDR process trees, script blocks, and isolation history that already sit off-host.
Identity and cloud
IdP sign-ins, token grants, control-plane APIs, and object-access logs that outlive any VM.
Network and mail
Proxy, DNS, packet captures when justified, and message traces for BEC and payload delivery.
A defensible analysis loop
Preserve first
Isolate without powering off if memory matters; snapshot cloud disks; hash collected files.
Document custody
Who collected what, when, from where, with which tool version.
Triage for scope
Answer dwell, data access, and persistence questions that change containment—not every curiosity.
Build the timeline
Normalize timestamps, resolve identities, and challenge gaps instead of filling them with guesses.
Report for action
Findings that IR, legal, and detection engineering can each use, with confidence stated plainly.
Forensics versus live response trade-offs
| Need | Live / EDR-first | Deep forensic |
|---|---|---|
| Stop ransomware spread | Isolate now, collect what you can remotely | Full image after containment if family or legal requires it |
| Prove data access | Cloud and DLP logs may already answer | Host artifacts when logging was incomplete |
| Court or regulator | Insufficient if custody was informal | Hashed images, tool logs, and written methods |
| Find unknown persistence | EDR hunts catch many, not all, rootkits | Memory and offline analysis for advanced implants |
- Write a collection playbook that names tools, hash algorithms, and storage locations.
- Prefer off-host telemetry that already exists; imaging is not the default first move.
- Never investigate by installing random tools on the patient system.
- Keep a clean analysis workstation; malware samples are not toys.
- Record time zones and clock skew; a wrong UTC conversion wrecks legal timelines.
- Scope questions in writing: data types, systems, and identities in play.
- Share sanitized TTP findings with detection engineering after the case.
- Know data-retention and privacy limits before imaging employee devices.
The practical takeaway
Forensic analysis turns a contained host into a trustworthy story of what happened. Preserve with hashes and custody, investigate to the questions that change response, and do not let “wipe and rebuild” erase the only map of the rest of the intrusion.
Related security terms
Incident Response
The broader handling process that forensics informs without replacing containment.
Audit Log
Central evidence that should already exist before a host is imaged.
Endpoint Detection and Response (EDR)
Often the first source of process trees and remote collection.
Log Correlation
Joins forensic artifacts with identity and cloud events.
Proof of Concept (PoC)
Exploit samples that may appear in evidence and must be handled safely.
Frequently asked questions
What is forensic analysis in simple terms?
It is the careful study of digital leftovers—disks, memory, logs, cloud APIs—to reconstruct an incident without destroying the evidence you need to prove it.
How is DFIR different from everyday SOC investigation?
SOC investigation is optimized for speed and containment. Forensic analysis adds preservation, documentation, and methods that can survive legal or regulatory scrutiny.
What is chain of custody?
A recorded history of who collected, hashed, stored, and accessed evidence, so later readers can trust it was not swapped or silently altered.
Should you always take a full disk image?
Not always. Live EDR collection, memory, and cloud audit logs may be enough and faster. Full images matter when persistence is unclear, legal holds apply, or the host will be rebuilt immediately.
Can you do forensics in the cloud?
Yes, but the artifacts change: control-plane logs, snapshots, object-versioning, and identity tokens matter more than pulling a physical drive.
When should legal be involved?
When evidence may support litigation, regulation, HR action, or law-enforcement referral. Collection methods should be defensible even if legal joins later.
What is a forensic timeline?
An ordered reconstruction of events across sources—file MAC times, logs, browser history, cloud APIs—used to answer scope, dwell, and data access questions.
References
Explore authoritative guidance and frameworks related to forensic analysis.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.