DFIR (Digital Forensics & Incident Response)

Definition

DFIR investigates security incidents and restores systems safely. It comes after SOC or Threat Hunting identifies a possible attack.

What Problem It Solves

Determines how the attack happened, what was affected, and how to recover.

What Happens If Not Used

Systems may be restored without removing the real cause, allowing attackers to return.

Easy Wording

DFIR is the digital investigation and recovery team after a cyberattack.

Layman Example

Police investigate a burglary, collect evidence, and secure the house.

Technical Example

Flow: SOC Alert/Threat Hunt → DFIR collects logs & disk evidence → Finds exploited VPN → Removes malware → Patches system → Restores services → Documents lessons learned.

Limitation: DFIR happens after an incident; prevention still depends on good security architecture, monitoring, and controls.