What is forensics in incident response?

• A. Collection and analysis of evidence (digital or physical) to reconstruct events and support investigations.
• B. Evaluating staff performance after an incident.
• C. Configuring network devices to prevent incidents.
• D. Documenting marketing communications.

Answer: (A)

In incident response, forensics is the collection and analysis of digital or physical evidence to reconstruct events and support investigations. This means preserving evidence integrity, maintaining a clear chain of custody, and examining artifacts such as logs, disk images, memory captures, and network traffic to answer what happened, how it happened, when it started, and who or what was involved. The purpose is to build an accurate timeline and determine the root cause, scope, and impact, so containment, eradication, and prevention efforts can be properly guided. Forensics also helps establish evidence that may be needed for legal, regulatory, or internal review purposes.

Other activities like evaluating staff performance after an incident, configuring network devices to prevent incidents, or documenting marketing communications fall outside this investigative evidence work and belong to different areas of security operations or business functions.