Understanding DFIR

Digital Forensics and Incident Response (DFIR) combines evidence-based investigation with the actions needed to control and recover from a security incident.

What you will learn

This page explains how forensics and incident response work together, what evidence may be available, how response choices can change that evidence, and where Velociraptor fits in an investigation.

Forensics and incident response

Digital forensics

Preserve and examine information from computers, accounts, networks, and cloud services to understand what happened.

Primary goal: Build a reliable explanation from evidence.

Incident response

Control the incident, remove the threat, restore normal operations, and reduce the chance of further harm.

Primary goal: Protect people, systems, and information.

These goals can compete. Acting quickly may stop an attacker, but shutting down or changing a system can remove useful evidence. The response team must balance immediate safety, business impact, and the need to understand what happened.

DFIR lifecycle

1. PrepareDefine roles, contacts, tools, access, evidence storage, and response plans before an incident.Be ready to act
2. DetectReceive an alert or report that suggests something may be wrong.Recognise a concern
3. TriageCheck the available information and decide urgency, likely impact, and immediate priorities.Set the direction
4. PreserveProtect useful information from accidental change, deletion, or loss.Keep reliable evidence
5. InvestigateBuild a timeline, test possible explanations, and identify affected systems, users, and information.Understand what happened
6. ContainLimit the attacker's access and prevent the incident from spreading further.Reduce immediate harm
7. Remove the threatRemove harmful software, close unwanted access, and correct the weakness that was used.Address the cause
8. Recover and learnRestore services, monitor for return, document the outcome, and improve controls and plans.Return safely and improve

The order can change

DFIR is not always a straight line. A serious active threat may require containment before complete evidence collection. New findings can also send the team back to earlier stages.

Common evidence sources

Memory

Information held by a running computer, including active programs, connections, and some temporary secrets. It is normally lost when the computer is powered off.

Stored data

Files, installed programs, system settings, logs, and traces of deleted activity held on disks or other storage.

System records

Records of sign-ins, program activity, errors, security events, and configuration changes.

Network activity

Connections made by the affected device, including destinations, timing, volume, and available protocol details.

Cloud and identity records

Account use, access changes, cloud actions, authentication attempts, and remote sessions.

Business context

The device owner, system purpose, important information, expected activity, and operational impact.

Try a response decision

A workstation is making suspicious network connections while a privileged account is being used unexpectedly. Choose response actions in the order you would perform them.

Record active activityCapture running programs, users, and network connections Collect memoryPreserve temporary information from the running device Isolate the deviceStop normal network access while leaving power on Protect the accountEnd active sessions and stop further account use Shut down the deviceStop all activity but lose information held in memory Create a forensic disk copyMake a controlled copy of stored data for examination

Your response order Reset

1. Select an action to begin.

Ready Balance safety and evidence There is no universal perfect order. Consider the active risk, evidence that may disappear, and actions that could change the device.

Use authorised procedures

This exercise is illustrative. Real response actions must follow the organisation's authority, safety, privacy, legal, and operational requirements.

Keeping evidence reliable

Forensic copy

A carefully created copy used for examination so the original device or data can remain protected.

Digital fingerprint

A calculated value, often called a hash, used to help show that a file or evidence copy has not changed.

Handling record

A chain of custody records who collected, handled, transferred, stored, and examined evidence, and when each action occurred.

Timeline

Events placed in time order to show what happened before, during, and after the incident. Correct system time is essential.

Questions an investigation answers

• What happened, and how confident are we?
• When did the activity begin and end?
• How was access gained?
• Which accounts, devices, services, and information were affected?
• What actions were performed?
• Was information viewed, changed, destroyed, or removed?
• Is the threat still active?
• What evidence supports each conclusion?
• What should change to reduce the chance of recurrence?

Investigations may not answer every question. Record uncertainty, competing explanations, and gaps in the available evidence.

Operational and legal considerations

• Authority: Confirm permission before collecting data, accessing accounts, or changing systems.
• Privacy: Limit collection and access because evidence may contain personal or sensitive business information.
• Secure storage: Protect evidence from unauthorised access, change, loss, and accidental deletion.
• Time accuracy: Incorrect clocks make it difficult to combine events into a reliable timeline.
• Collection impact: Investigation tools can change a running system and may affect performance.
• Data volume: Memory, disk copies, logs, and cloud records can require significant storage and transfer time.
• Remote evidence: Cloud services and remote devices may need different access and collection methods.
• Documentation: Record actions, reasons, results, assumptions, and errors as the investigation progresses.
• Reporting: Follow the organisation's legal, contractual, and regulatory notification requirements.

Velociraptor platform profile

Velociraptor is an open-source platform for collecting and examining information from many endpoint devices. An endpoint is a computer or server connected to the organisation's environment.

Area	Evaluation starting point
Best suited to	Teams that need to ask investigation questions across many computers and collect defined evidence remotely
Query model	Velociraptor Query Language (VQL) describes what information to find and how to process it
Investigation use	Search for known warning signs, collect system information, review activity, and run approved response tasks
Operational planning	Server and client deployment, permissions, network use, collection impact, storage, monitoring, and upgrades
Important boundary	Velociraptor supports endpoint collection and investigation but does not replace every specialist forensic tool or procedure

Open Velociraptor guide ›

Continue learning

• Explore Velociraptor to collect and investigate endpoint evidence.
• Understand SIRP to review case ownership, evidence records, and incident coordination.
• Understand NTA to examine network evidence during an investigation.