Understanding DFIR

Digital Forensics and Incident Response (DFIR) combines evidence-based investigation with the actions needed to control and recover from a security incident.

What you will learn

By the end, you should be able to explain how forensics and incident response work together, identify useful evidence, order initial response actions, and choose a suitable DFIR solution in this kit.

What is DFIR?

Core concept

DFIR is the coordinated practice of preserving and examining digital evidence while containing threats, removing their cause, and restoring normal operations. It helps a team explain what happened and act on that explanation without unnecessarily destroying useful evidence. Digital forensics builds the explanation; incident response limits harm and returns operations to a safe state.

Endpoint artefactsMemoryLogsNetwork activityBusiness context

Keep in mind: Fast action and careful evidence handling can compete. The right decision depends on immediate risk, authority, business impact, and which evidence may disappear.

01ArtefactA digital trace that may help explain activity 02Volatile evidenceTemporary information that may disappear when a system changes or powers off 03Chain of custodyA record of who handled evidence, when, where, and why

What DFIR is not

DFIRPreserve evidence, reconstruct activity, and coordinate recovery

SIEMCollect and correlate security events

EDRMonitor and respond on endpoints

SIRPTrack cases, ownership, evidence, and tasks

BackupRestore data and systems from known copies

Connected, but not interchangeable

DFIR uses evidence from SIEM, EDR, network, identity, and cloud systems. A case platform can coordinate the work, but none of these capabilities alone guarantees reliable evidence handling or a defensible investigation.

Observation, finding, and conclusion

01ObservationA recorded fact, such as a process, file, login, or connection

→

02FindingRelated evidence that supports a tested explanation

→

03ConclusionA bounded account of what happened, with confidence and limitations

A suspicious artefact is not proof

Analysts must validate origin, timing, context, and integrity before using an artefact to support a conclusion. Record uncertainty and competing explanations.

Why DFIR matters

Reconstruct activity

Combine endpoint, identity, network, cloud, and business evidence into a timeline that explains what occurred.

Limit harm

Identify affected systems and accounts so responders can contain the threat without making unsupported changes.

Preserve reliable evidence

Protect originals, verify forensic copies, and document handling so another person can review the work.

Recover and improve

Restore services safely, monitor for recurrence, communicate the outcome, and improve controls using what the investigation revealed.

How DFIR works

1. PrepareDefine authority, roles, contacts, tools, access, evidence storage, and recovery plans before an incident.Be ready to act
2. Detect and triageValidate the concern, estimate urgency and impact, and decide which evidence and systems matter first.Set direction
3. PreserveRecord the live state and protect useful information from accidental change, deletion, or loss.Keep evidence reliable
4. InvestigateBuild a timeline, test explanations, and identify affected systems, users, services, and information.Explain what happened
5. ContainLimit unwanted access and spread while considering evidence, safety, and operational impact.Reduce immediate harm
6. EradicateRemove harmful software, persistence, and unwanted access, then correct the weakness that was used.Address the cause
7. Recover and learnRestore from a known-good state, monitor for recurrence, document conclusions, and improve controls and plans.Return safely and improve

The order can change

An active threat may require early containment, while new evidence can send the team back to triage or investigation.

Make an initial response decision

A workstation is making suspicious network connections while a privileged account is being used unexpectedly. Order the actions while balancing evidence that may disappear against the need to limit immediate harm.

Try it: balance safety and evidence

Select response actions in the order you would perform them. Watch how an early shutdown affects memory evidence, then reset and try a sequence that records volatile activity while containing the device and account.

Record active activityCapture running programs, users, and network connections Collect memoryPreserve temporary information from the running device Isolate the deviceStop normal network access while leaving power on Protect the accountEnd active sessions and stop further account use Shut down the deviceStop all activity but lose information held in memory Create a forensic disk copyMake a controlled copy of stored data for examination

Your response orderReset

1. Select an action to begin.

Ready Balance safety and evidenceThere is no universal perfect order. Consider the active risk, evidence that may disappear, and actions that could change the device.

Exercise debrief

Record volatile activity before shutdown when it is safe to do so. Isolation and account protection can then limit harm while preserving the powered-on system. Document why the chosen order fits the incident.

Use authorised procedures

Real response actions must follow organisational authority, safety, privacy, legal, and operational requirements.

What makes DFIR useful

Start with an investigation question

Did the suspicious account activity affect this workstation?

1. 1Define scopeIdentify the question, authority, systems, accounts, time range, and immediate risks.
2. 2Preserve evidencePrioritise volatile and relevant data, record provenance, and protect originals.
3. 3Test explanationsBuild a timeline, compare sources, challenge assumptions, and record gaps.
4. 4Act and reportContain proportionately, recover safely, and state conclusions with confidence and limitations.

!Plan for operational friction

Missing evidenceVolatile dataClock differencesCollection impactPrivacy constraintsUnclear authority

DFIR tools accelerate collection and analysis, but investigators still need secure storage, access control, documented handling, enough capacity, specialist judgement, and reviewable reporting.

Keep evidence reliable

Protect originals, verify copies, document handling, and account for time differences so another investigator can review the evidence.

Forensic copyVerified hashHandling recordNormalised timeline

DFIR solutions in this kit

The available solutions serve different parts of a DFIR workflow. Choose the route that matches whether you need remote endpoint collection or a workstation containing several specialist analysis tools.

Available now · Remote endpoint investigation

Velociraptor

Choose it when: You need to ask investigation questions across endpoints and collect defined evidence remotely.

Workflow: Deploy clients, use VQL and artefacts, run targeted collections or hunts, and review results.

Strength: Repeatable collection and investigation across one or many endpoint devices.

Plan server and client deployment, permissions, network use, collection impact, storage, monitoring, and upgrades. It does not replace every specialist forensic tool or procedure.

Coming soon · Forensic analysis workstation

DFIR VM (SUSA)

Choose it when: You need a prepared workstation containing a suite of DFIR tools for examining collected evidence.

Workflow: Bring authorised evidence into an isolated analysis environment, select the appropriate tool, examine artefacts, and document findings.

Strength: Multiple complementary forensic utilities in one purpose-built environment.

The DFIR VM guide is under development. Tool inventory, installation, evidence-handling workflow, and hands-on exercises will be published here.

Choose the evidence path first

Start with Velociraptor when evidence must be collected or hunted across endpoint devices. Use DFIR VM (SUSA) for workstation-based analysis once its guide is available. These approaches can complement each other: collect remotely, preserve the result, then use suitable specialist tools to examine it.

Continue learning

• Explore Velociraptor to collect and investigate endpoint evidence.
• Understand SIRP to review case ownership, evidence records, and incident coordination.
• Understand NTA to examine network evidence during an investigation.