Digital forensics and incident response encompass multiple disciplines that offer investigators an opportunity to specialize or take on a broad set of tasks. Investigators might need to examine evidence from cloud services and EDR tools, using AI agents to speed up the work while remaining accountable for the conclusions.
I speak with a lot of security professionals who are seeking to enter or grow in the field of digital forensics and incident response. There is a lot of confusion regarding the work that such individuals do and what opportunities exist to join or excel within their ranks. This is worth discussing.
Computer and Digital Forensics
Computer forensics, often seen as a subset of digital forensics, typically involves examining computers for signs of malicious or illegal activity. The activity might have been carried out by the computer’s user who is being accused of a crime or by a person or malware that compromised the system. Historically, that meant examining the computer’s hard drive.
Today’s IT ecosystem encompasses more than just computer systems and their hard drives, which is why digital forensics is seen as a broader practice of examining digital artifacts in databases, memory, network traffic, and mobile devices. Investigators also examine the logs of cloud services, SaaS apps, and identity services. In many incidents, useful evidence comes from telemetry captured by endpoint detection and response (EDR) tools. Sometimes digital forensics also involves e-discovery work to support litigation efforts.
The forensic depth an incident needs depends on the purpose of the investigation. In his book Dynamic Incident Response, Joshua Wright distinguishes a short-form investigation, in which responders gather enough understanding to decide how to eradicate the attacker’s presence, from a long-form investigation that they may pursue in parallel. A long-form investigation might be needed for regulatory compliance, legal proceedings, and insurance claims.
Computer Security Incident Response
Incident response (IR) is often viewed as a subset of or a complement to digital forensics. After all, handling a suspected malware infection, system compromise, or data breach usually involves examining digital artifacts to assess the situation. Performing IR may also include examining a live system by running commands on it to survey the affected host.
The IR process may also involve coordinating actions of the individuals and organizations involved in or affected by the incident—a task that involves strong communication skills, business savvy, and a perspective on public relations. The coordinator also needs to capture and share findings in a form that colleagues, such as executives and legal professionals, understand, often as an incident report.
IR is also part of an organization’s broader security program. In SP 800-61r3, NIST ties incident response to the six functions of its Cybersecurity Framework (CSF) 2.0, which span the security program from governance to recovery. I describe how IR relates to other security teams in my article on the security incident cycle. If you’re building these capabilities in your organization, see my tips for starting an IR program.
Malware Analysis
When performing digital forensics and/or incident response, the examiner might encounter malware in the form of obfuscated scripts, exploit-ridden documents, and malicious executables. Examining these artifacts to understand their capabilities requires a specialized malware analysis and reverse-engineering skill set. (I teach a malware analysis course at SANS.)
The malware analyst (a.k.a. reverse engineer) needs to examine the malware sample to determine how it interacts with its environment and what capabilities are built into its code base. The analyst may be asked to document the sample’s malicious capabilities, understand its propagation characteristics, and define indicators for detecting its presence. For a summary of these techniques, see my malware analysis cheat sheet.
AI in Digital Forensics and Incident Response
AI agents can perform some of the work in each of these disciplines, such as reviewing logs, analyzing malware, and writing the first draft of an incident report. However, it’s up to the investigator to direct the AI’s work, verify its findings, and be accountable for the conclusions. I outline how to use AI for malware-focused investigations in my AI-assisted malware analysis tips.
People should also approve response actions that are hard to undo, such as wiping a system or deleting cloud resources. I describe how to decide what the AI may do on its own in the Security Autonomy Matrix.
The logs maintained by AI systems are becoming a valuable source of evidence. When an incident involves an AI agent, the investigator will want to examine the agent’s prompts and logs related to the tools that it called and the actions it performed.
Digital Forensics and IR Career Options
As you can see, there are several disciplines within the overall field of digital forensics and incident response (DFIR). As a result, there are many opportunities for specialization. The numerous options, while initially confusing, also make it easier for individuals to find an area that interests them, building upon their prior experiences while leaving room for professional growth. Practitioners of related specialties, such as threat hunting, detection engineering, and cyber threat intelligence, often build on the findings of DFIR work.
One of the challenges for those looking to enter this field is that employers often focus their recruitment efforts on experienced forensicators, rather than investing in personnel who could mature as part of the group. In some cases, individuals burn out from working hectic hours that leave little time for professional development.
Newcomers to the field need to become familiar with technologies relevant to the types of investigations they’ll be performing, whether focused on Windows, Linux, cloud infrastructure, etc. They can also stand out by understanding the role AI plays in an organization’s processes and by being familiar with using AI to speed up investigative tasks and with verifying the AI’s findings.
For ideas on building DFIR skills within your current role, see How to Get into Digital Forensics or Incident Response.
