What Is DFIR? Forensic Process, Evidence, and Legal Rigor

Containing an incident often means rebuilding hosts, resetting credentials, and letting logs roll over, and each of those steps can destroy evidence. DFIR teams preserve that evidence while containing the threat, so counsel, insurers, and auditors aren't left with questions the remaining record can't answer.

Digital forensics and incident response (DFIR) combines stopping and recovering from security incidents with preserving and analyzing evidence of what happened. Most teams do both at once, under pressure, using endpoint, cloud, SaaS, and identity evidence that expires on vendor-set clocks. Core principles such as protecting integrity, documenting handling, and collecting volatile evidence first have held steady since RFC 3227 was published in 2002. Where that evidence lives and how long it survives have changed as workloads moved to cloud and SaaS.

TL;DR:

• Forensics and incident response share evidence but pursue different goals: IR contains threats and restores service, and forensics reconstructs events so outsiders can rely on the findings.
• Default log retention on common identity and cloud sources can expire before investigators reach initial access, and no setting change recovers events a source never recorded.
• EDR telemetry alone is an incomplete forensic record, and memory, disk, and browser artifacts often fill the gaps.
• Litigation, regulators, payment brands, insurers, and law enforcement decide whether forensics has to be legally defensible, and that call has to be made before collection starts.

What DFIR Means, and Where Forensics and IR Diverge

NIST SP 800-86 is the agency's 2006 guide to forensics in incident response. It defines digital forensics as "the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data." Incident response is the remediation or mitigation of security policy violations. DFIR covers both, and the term replaced computer forensics as the field expanded to more devices and data sources.

The two pull in different directions, a tension DFIR practitioner Jason Jordaan describes in a SANS webcast. NIST's current IR guide, SP 800-61 Rev. 3, treats rigor as a per-incident decision: formal chain-of-custody handling might not happen for every incident, since most malware cases never reach prosecution. Cloud tooling can run both as one continuous workflow, but the evidentiary standard still depends on who will read the report.

They split on goal, timing, rigor, and output:

‍

Forensic work sits inside the broader incident response lifecycle, alongside detection, containment, and recovery.

The Forensic Process: Collection, Examination, Analysis, Reporting

SP 800-86 splits the work into collection, examination, analysis, and reporting, with preservation running alongside collection from the start. ISO/IEC 27037, a 2012 standard that is still current, and ISO/IEC 27042 cover the same ground for handling and analyzing digital evidence.

1. Preservation and Collection

Preservation starts with the decision to keep evidence. NIST's guidance is that when it's unclear whether evidence will be needed, it should generally be preserved. For physical media, that means write blockers and hashing. Record the original's digest, image the drive, hash the copy, then rehash the original to confirm imaging didn't alter it.

A virtual disk in a provider's data center can't be attached to a write blocker, so cloud teams take snapshots. A snapshot fixes its point in time the moment it starts, even though an EBS snapshot can stay pending for several hours while its data copies to S3. Physical imaging is slower to get going: SANS estimates that imaging a 1 TB drive over USB 3.0 takes 40 minutes to three hours.

Many preservation failures are procedural. Reimaging a host before imaging the original drive destroys the forensic baseline. Clearing logs or patching before documenting can hide how the attacker got in.

RFC 3227 set the rule: "When collecting evidence you should proceed from the volatile to the less volatile." Registers, caches, and memory come first, followed by temporary file systems, disk, remote logs, and archival media. The RFC also says not to shut a system down before collection, since attackers may tamper with shutdown scripts, and not to trust programs on the compromised system.

Where initial mitigation isn't possible, CISA's #StopRansomware guide tells enterprises to image and capture memory from a sample of affected hosts. It also says to preserve short-retention evidence such as Windows Security logs and firewall log buffers. AWS's EC2 acquisition workflow captures memory before live response, isolation, or shutdown to keep volatile data.

2. Examination

Examination turns collected data into material investigators can assess. Under SP 800-86, analysts extract the relevant files, records, and artifacts with documented automated and manual methods while keeping the collected evidence intact.

3. Analysis

Analysis runs on preserved copies wherever possible, because opening files changes their access times. When live collection or direct queries are unavoidable, document the method and any changes it may introduce. Trust file headers over file extensions, and stick to legally justifiable methods.

In Unit 42's 2026 report, investigators reviewed evidence from two or more distinct sources in 87% of incidents. A forensic timeline today usually means joining several vendor log formats, each with its own clock and retention period.

4. Reporting

The report describes the actions taken, why each tool and procedure was chosen, and what still needs doing. Its formality depends on the audience, but the notes behind it should cover every step, including who was present and what they did. For work that may reach a court, SWGDE's best practices ask examiners to stay neutral and report only what the data shows.

Where DFIR Evidence Lives: Cloud, SaaS, Identity, Endpoint

Retention windows decide much of what a cloud or SaaS investigation can prove. In M-Trends 2026, cyber espionage and North Korean IT worker intrusions went undetected for a median of 122 days. In Mandiant's BRICKSTORM investigations, an average dwell time of 393 days outlasted log retention, and the artifacts of the initial intrusion were gone. Logging is not retroactive: if a source wasn't configured to log before the incident, the data was never recorded.

1. Cloud Control Planes and Workloads

AWS logs CloudTrail management events by default. Data events, network activity events, and Insights are off, and S3 object-level data events cost extra and must be selected per resource type. CloudTrail event history keeps 90 days of management events per Region, with no organization-level aggregation.

In GCP, Admin Activity and System Event audit logs are always written and kept in the _Required bucket for 400 days. Data Access logs are disabled by default except in BigQuery, and once enabled they land in the _Default bucket, which keeps entries for 30 days unless a project extends it.

EKS and AKS both leave Kubernetes control-plane logs uncollected until someone routes them to a destination. Azure teams also face a deadline: NSG flow logs retire on September 30, 2027, new ones can no longer be created, and Microsoft recommends moving to virtual network flow logs.

Short-lived workloads shrink the window further. Sysdig's 2025 report found that 60% of containers live one minute or less. Cloud incident response on that kind of infrastructure depends on preservation set up in advance.

AWS recommends termination protection and EBS snapshots for compromised instances, with artifacts kept in read-only storage such as S3 with Object Lock. Without an immutable archive in a separate account, an attacker who reaches the right role can disable CloudTrail and delete the logs.

2. SaaS and Identity Platforms

SaaS data was relevant to 23% of the cases in Unit 42's 2026 report, and identity-based techniques drove 65% of initial access. Default retention on these platforms varies widely:

‍

In the 2023 Okta support-system breach, an attacker accessed support files belonging to 134 customers. Some were browser session recordings (HAR files) containing session tokens, which the attacker used to hijack five customers' sessions. For adversary-in-the-middle attacks, Invictus treats Entra sign-in logs as the primary source, because the same Session ID shows up across different IP addresses.

3. Endpoints: EDR Telemetry Versus Acquisition

Responders often check EDR first, and its retention and coverage limit how far back and how wide they see. Microsoft Defender for Endpoint retains data for 180 days, though advanced hunting exposes 30 days of native Defender XDR data unless a Microsoft Sentinel workspace with longer retention is onboarded. EDR coverage depends on the sensors, integrations, and collection settings in place, and attackers sometimes bypass or subvert the agent. M-Trends 2026 describes attackers targeting edge and network devices, such as VPNs and routers, that typically lack EDR telemetry.

Memory and disk acquisition cover much of what EDR misses. SANS FOR508 warns that some fileless attacks may be nearly impossible to reconstruct without memory analysis, and disk images preserve deleted files and unallocated space.

Prefetch, Amcache, SRUM, LNK files, and ShellBags each record different traces of program execution, file presence, resource use, and user activity, and each needs interpreting in context. Triage tooling makes acquisition cheaper: Kroll says that typically less than 10% of a full image has forensic value, and its KAPE triage tool collects and processes the useful artifacts in minutes.

4. Browsers

Browsers hold history, downloads, extensions, cookies, cache, and session data, and infostealers target the session tokens. MITRE T1539 notes that cookies sit on disk and in browser process memory.

Browser evidence also has limits, especially when AI-assisted analysis builds the timeline. A recorded visit does not show everything the user saw, and a browser event near a network alert does not automatically explain it. In ClickFix-style initial access, the pages visited before and after the suspicious activity may explain how it started.

Every conclusion has to trace back to evidence, because one invented timeline step can change what gets investigated or remediated. An investigation can trace a suspicious domain connection through process lineage, browser history, and downloaded files to show whether it was malicious or a benign redirect.

When Forensics Has to Be Legally Defensible

Forensics needs to be legally defensible when someone outside the organization will test the findings, and each kind of reviewer brings its own preservation, documentation, and evidence requirements. Jordaan's webcast notes that a legal outcome is far from the reality for most organizations, but these situations raise the bar:

• Litigation, including plausible lawsuits, employee misconduct, and insider cases.
• Regulatory notification. HIPAA presumes an unauthorized disclosure of protected health information (PHI) is a breach unless a documented risk assessment shows a low probability of compromise. Under SEC Item 1.05, covered registrants must file an 8-K within four business days of determining that an incident is material.
• Payment card compromise. When the payment brands require a forensic investigation, a PCI Forensic Investigator (PFI) sets the evidence scope under the PCI PFI program.
• Cyber insurance claims, where the policy may dictate which firm investigates.
• Law enforcement referral. DOJ guidance calls early referral the best way to ensure evidence is properly secured.

In U.S. federal proceedings, the other side can examine the process behind the evidence. FRE 901 requires evidence sufficient to support a finding that an item is what its proponent claims. Rule 902(14) makes copied data self-authenticating when a qualified person certifies it was verified by digital identification such as a hash, provided the other side gets notice and a chance to inspect it.

The 2017 committee note on Rule 902(14) says identical hash values for the original and copy "reliably attest to the fact that they are exact duplicates." The same note limits the certificate to authenticity, leaving hearsay and other objections to the contents in play. Expert testimony must also clear Rule 702, amended on December 1, 2023. The side offering the expert has to show the testimony more likely than not rests on enough facts and reliable methods, reliably applied.

FRCP 37(e) covers electronically stored information lost because reasonable preservation steps weren't taken and that can't be restored or replaced. On a finding of prejudice, a court can order curative measures, and adverse-inference instructions or dismissal require a finding of "intent to deprive."

Decision Criteria: How Much Forensic Rigor an Incident Needs

Custody and acquisition records start at collection, and later documentation can't fully repair an undocumented handling history. Set the rigor level first. SP 800-86 places the decision on whether to preserve evidence for possible legal or disciplinary proceedings before collection starts, guided by policy and legal advice.

For a low-impact incident with no legal, regulatory, contractual, or disciplinary implications, documented triage collection is usually proportionate. Reassess if new evidence changes the incident's significance.

If PHI, cardholder data, or EU personal data may be involved, preserve as though the work will be reviewed: hash images, keep a custody log, and document your methods. GDPR's 72-hour window for notifying the supervisory authority and HIPAA's 60-day outer limit for notifying individuals often start before the forensics are finished. If card data is in scope, isolate affected systems from the network without altering or powering them off, and leave further steps to the PFI.

If litigation is reasonably anticipated, bring in breach counsel early to structure the investigation, often through a separate forensic firm or statement of work that keeps it apart from operational remediation. If you carry cyber insurance, check panel requirements before engaging any vendor, because engaging one before consent may leave those costs uncovered.

If your cloud and SaaS logs default to 90 days or less, extend retention or export logs to storage you control now. CISA's ransomware guide recommends keeping logs for critical systems for at least a year where possible.

How Containment and Court-Grade Forensics Divide the Work

For teams with a managed response provider, containment usually fits inside the existing contract. Responders with integrated response controls can isolate hosts, reset credentials, and block IOCs within their agreed scope. Court-grade forensics adds imaging, chain of custody, breach counsel, and sometimes expert testimony, and it typically runs as a separate engagement.

Daylight's MDR covers investigation and response under its contract, and a legally defensible forensic engagement still needs its own preservation and custody process.

Frequently Asked Questions About DFIR

Does EDR Telemetry Hold Up as Forensic Evidence?

It can, though the federal rules have no EDR-specific provision. In U.S. federal proceedings, an EDR export could be authenticated through testimony under Rule 901 or a certification under Rule 902(13), which covers records from an electronic process that produces an accurate result. Its completeness can still be challenged, for example when agent gaps or exclusions left activity unrecorded.

Is Full Disk Imaging Still Necessary if We Have Logs?

Not always. Targeted collection of the MFT, USN journal, registry hives, event logs, Prefetch, and Amcache is often enough to scope an incident. Bit-stream images earn their cost on critical systems and on anything headed for court, where the other side may want to examine the full disk. Timestomping and event log clearing can undermine timestamps, so corroborate key times across independent artifacts.

How Do You Preserve Evidence From Autoscaling Workloads?

Trigger capture automatically from the alert or the scale-in event. Capture memory first where the workload allows it. Then take disk snapshots through cloud APIs instead of running live response inside a compromised OS, copy them to an isolated forensic account, and hash the resulting images. Microsoft's reference architecture stores snapshots in immutable blob storage in a separate SOC subscription and keeps the hashes in a dedicated key vault.

How Long Should Forensic Evidence Be Retained?

NIST IR 8387, a 2022 guide for evidence handlers, says that absent a statute or jurisdictional policy, organizations should retain evidence for a period they define after adjudication, including appeals. HIPAA requires covered entities to keep breach documentation for six years. A legal hold notice doesn't stop automated log deletion, so exports or retention changes need to start when the hold does.

Should Forensic Collection Wait Until Containment Is Finished?

Usually not, and it shouldn't hold containment up either. Isolating a host from the network contains it while keeping memory intact, so collection can run in parallel. Powering a system off or reimaging it first can lose encryption keys and other data held in memory. When a shutdown can't wait, record what evidence the action changed or lost. Proven Data argues that when containment and forensics go to separate vendors, the two goals compete and the client ends up arbitrating, so settle handoff terms before an incident.