What is digital forensics and incident response (DFIR)?

Cybersecurity best practices tend to focus more on actions that help avoid or prevent an incident. And while those things are certainly important, cyberattacks are happening more often and with more sophistication. As a result, cybersecurity incidents are now a matter of "when," not "if."

Because of this, it's a good idea to consider the steps to take during and after an incident. How do you investigate? How do you recover? How do you prove that a cybercriminal attacked your business and address the resulting impact?

The answer is simple: digital forensics and incident response (DFIR).

Learn all about DFIR from Field Effect's incident response experts.

Watch now

In this blog, you’ll learn:

• What DFIR is and why it’s important
• Critical steps in the DFIR process
• Where DFIR fits into your overall cybersecurity strategy
• The skills and tools needed for DFIR

What is digital forensics & incident response?

Digital forensics and incident response (DFIR) is a specialized field focused on identifying, remediating, and investigating cybersecurity incidents.

As the name suggests, DFIR consists of two related components:

1. Digital forensics involves collecting, preserving, and analyzing forensic evidence
2. Incident response involves containing, stopping, and preventing a cyberattack

DFIR fuses traditional incident response (IR) activities—such as response planning and rehearsal, IT architecture documentation, and playbook development—with digital forensics techniques.

While traditional IR usually carries some investigative elements, DFIR takes it to another level by emphasizing digital forensics.

With DFIR, businesses can return to business after a cyberattack and improve their resiliency against future attacks at the same time. Given just how expensive and damaging a single attack can be, it’s more important than ever to know how to respond to a cybersecurity incident if you’re targeted.

Let's dive deeper into the two individual components of DFIR.

What is digital forensics?

Digital forensics is a branch of forensic science that covers digital technology. Analysts focus on the recovery, investigation, and examination of material found on digital devices.

The end goal of digital forensics is to gather and preserve evidence to aid in prosecuting cybercrime, should the culprits behind an attack face criminal charges.

Generally, an organization engages in digital forensics to:

1. Confirm the occurrence of a cyberattack
2. Understand the full impact of a cyber incident
3. Identify the cause behind a cyberattack
4. Collect evidence proving a cyberattack occurred

Like any forensic investigation, speed is critical, especially if an attack is ongoing. Acting fast can help stop in-progress security incidents and reduce overall damage to the victim organization.

Computers, networks, and devices continuously produce data that could potentially be crucial to an investigation, even while sitting idle. Over time, the risk that this data is deleted, overwritten, edited, or otherwise maliciously altered increases.

Many forensic artifacts depend highly on the state of a computer in the immediate aftermath of an incident. Forensic investigators must move quickly to ensure they capture all this information before it's lost or unrecoverable.

Do you know the key indicators of a security compromise?

Get this cheat sheet to learn the key indicators of email, mobile device, and host or server compromises, and what to do if you've been compromised.

Download now

What is incident response?

Incident response (IR), on the other hand, is a set of activities carried out during a cybersecurity incident. For this purpose, a cyber incident can be defined as any event that compromises information confidentiality, integrity, or availability—core principles of information security often referred to as the “CIA triad.”

IR activities are typically informed by an IR plan designed to get IT infrastructure back up and running as quickly as possible while mitigating the overall damage of an incident.

First and foremost, these frameworks are designed to support recovery efforts. In a broader sense, they also help organizations build cyber maturity and proficiency. This may help enhance defenses, stopping attacks and incidents from affecting businesses in the first place.

Why is DFIR important in cybersecurity?

For businesses experiencing a cyberattack, recovery is top-of-mind. But beyond getting back up and running, it’s also important to understand the how and why behind an incident.

DFIR delivers that deeper understanding through a comprehensive and intricate forensic process. Specialists gather and inspect a wealth of information to determine who attacked them, how they got in, the exact steps attackers took to compromise their systems, and what they can do to close those security gaps.

The digital forensic process

The digital forensic process is the accepted method investigators follow to gather and preserve digital evidence, with the express intent of maintaining a chain of custody. It consists of three key steps:

1. Acquisition

In this step, investigators create an exact duplicate of the media in question, usually using a hard drive duplicator or specialized software tools. The original media is secured to prevent any tampering.

2. Analysis

Forensic specialists then analyze the duplicated files or technology, logging all the evidence they discover that supports or contradicts a hypothesis.

Ongoing analysis is conducted to reconstruct events and actions in an incident, helping them reach conclusions about what happened and how hackers compromised systems.

3. Reporting

Once a digital forensics investigation is completed, the findings and conclusions analysts uncovered are delivered in a report that non-technical personnel can understand.

These reports are passed on to those who commissioned the investigation and usually wind up in the hands of law enforcement.

Types of digital forensics data

During the acquisition phase of the digital forensic process, analysts look for a variety of forensic data to help them in their investigation:

• Disk images. Generally speaking, a disk image refers to a copy made of a digital storage device. Disk images are bit-for-bit copies of devices, usually of hard disks or hard drives. Sometimes, images may be taken of a USB drive or other storage medium.
• Memory images. A computer’s RAM can be recorded by special software, similar to a disk image. Memory images are vital because some advanced techniques or threat actors are undetectable on disk.
• Application data. If a disk or memory image is unavailable or irrelevant, investigators sometimes turn to application data (such as host logs, network device logs, and software-specific logs) instead.

What is the chain of custody?

According to the National Institute of Standards and Technology (NIST), the chain of custody is a “process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for any transfers.”

In other words, it's documentation that proves that the evidence used to prosecute a cybercrime is, in fact, legitimate evidence and was not placed fraudulently or edited for malicious purposes.

Why is digital evidence important?

Think of every police procedural story you’ve read or seen on TV. Detectives catch the bad guys by uncovering and documenting evidence that helps them recreate the exact circumstances surrounding a crime. Digital evidence is no different: it comprises significant information transmitted or stored on a digital device during a crime.

Broadly speaking, digital evidence should meet five key criteria:

1. It is admissible in court
2. It is authentic
3. It is complete
4. It is reliable
5. It is believable

DFIR investigators will gather this information and store it safely to prevent contamination to ensure it remains admissible in court.

The right cybersecurity solution can stop incidents before they happen.

Learn more

But it’s not the only sort of evidence they collect; investigators may also assess and document:

• Analogical evidence—comparable incidents or events potentially relevant to understanding the case in question.
• Anecdotal evidence—stories and accounts from other parties that may support a theory when analyzing a situation. Anecdotal evidence is not admissible in court but may still be useful during an investigation.
• Circumstantial evidence—indirect evidence that makes inferences based on a series of facts, typically to draw conclusions in connection with a crime. This may also be understood as a hypothesis based on known facts, and may also be useful during an investigation.
• Character evidence—this includes individual expert testimony that may help prove intent, motive, and opportunity. It could also include expert testimony about an attack.

How do you store digital evidence?

In theory, gathering digital evidence should be as simple as pulling out a hard drive infected with ransomware. In practice, it’s not quite so simple.

Some types of digital evidence are deemed volatile or non-persistent because the data is only accessible when that device is plugged in or connected to power. Non-volatile or persistent digital evidence, meanwhile, is stored permanently in memory. This may include read-only memory, data in flash memory, or even data on a CD-ROM or other disc.

In many cases, investigators cannot and will not power down affected technology to preserve digital evidence.

Because of these challenges, DFIR investigators typically start by duplicating a hard drive via drive imaging, a process that creates a bit-to-bit perfect duplicate of a drive affected by an attack. As a rule, investigators will operate exclusively on this duplicate drive when investigating. This allows them to explore and test hypotheses on the drive without impacting the actual evidence.

The imaging process also generates cryptographic hash values, which are used to verify the authenticity of a drive image. Wherever possible, evidence gathered will be stored in a secure location where it can be preserved and accessed for reference later, with added physical security to ensure no item can be compromised.

The challenges of DFIR investigations

DFIR is a multidisciplinary field combining soft skills with specialized technical ones. As such, team members will generally have a unique mix of skills, traits, and experience they bring to bear in their role.

By no means a complete list, those skills and experience may include:

• File system forensics—understanding how to apply digital forensics basics via software agents to analyze machines on a file system, including remote devices.
• Memory forensics—the ability to analyze volatile forms of evidence like system memory for signs of compromise is extremely useful, especially for certain malware strains that aren’t detectable on disk.
• Network forensics—did an infection begin as a malicious email or link? Understanding how to analyze network activity remains highly useful in digital forensics.
• Malware triage—reverse-engineering malware can help DFIR teams identify particular strains and better address the damage these attacks cause.
• Log analysis—log analysis is frequently automated to save time but remains valuable for detecting abnormal activity on a system.
• Software development—technology is always changing; having a solid understanding of software development can help DFIR teams better understand what they’re protecting. Being able to code and script can be a game-changing skill.
• Communication—good communication is vital for incident response, be it with team members, affected organizations, or management.
• Teamwork—DFIR teams are never working alone. Incident response is a high-stress situation that requires team members to understand how to delegate tasks to each other and coordinate their efforts in service of a common goal.
• Analytical thinking—being able to gather information, challenge your own assumptions, and test theories can help teams reach better conclusions. It’s a challenging soft skill to build, but immensely valuable for DFIR.

This is a long list of skills and areas of expertise, and organizations are often hard-pressed to find qualified individuals with relevant experience who will also be a good fit for your business.

Many organizations are turning to external consultants or third-party providers to handle their digital forensics and incident response needs.

Getting started with DFIR

In today's world, it's simply not possible to achieve 100% cybersecurity. Accidents happen, whether at the human or technical level. When they do, it's important to have DFIR processes in place to prevent or greatly reduce data theft, intellectual property theft, and financial fraud, among other cybercrimes. It also helps identify vulnerabilities in an organization's security infrastructure, which is essential for preventing future, similar attacks.

Our team of experienced cybersecurity experts can work with you to help you build your capabilities and ensure your organization can recover in the event of an attack. After all, investing in readiness and advanced preparation saves both time and money later on, should an incident happen.

Interested in taking the first step? Our Incident Response Readiness Service is designed for any organization looking to be prepared to respond to an incident effectively. You'll receive a dedicated cybersecurity advisor who helps build an incident response plan and incident response playbooks that guide you through the six most common types of compromise. 

And, our digital forensics and incident response experts are available any time of day or night, so reach out if you believe you're experiencing a cyberattack or compromise.