Definition
Forensics, also known as digital forensics, is the branch of cybersecurity focused on the identification, preservation, analysis, and presentation of digital evidence. It involves systematically collecting and examining data from electronic devices to uncover facts about a digital incident or crime. This process is crucial for understanding the scope of a security breach, identifying perpetrators, and reconstructing events. For instance, forensic investigators might analyze log files and network traffic to determine how malware infiltrated a system. Unlike incident response, which aims to contain and eradicate threats, forensics prioritizes evidence integrity for potential legal proceedings. This subject is a core component of certifications like CompTIA Security+ and CySA+.