Digital Incident Response

What it is and why it matters

A forensic examination usually begins after the event, with time to plan. An incident begins in the middle of the night with a ransom note on every screen, a regulator's deadline ticking and a board asking whether the business is still running. Incident response is the discipline of acting well under that pressure. It borrows the methods of digital forensics and adds decisions about containment, communication, recovery and reporting that a laboratory examiner never has to make.

The structure is well established. An organisation prepares by knowing its systems, keeping logs, having a plan and training a team. It detects and analyses the incident to understand its scope. It contains the attacker, eradicates their access and recovers systems. Then it learns from the event. NIST SP 800-61 Rev. 3, published in 2025, places these activities inside the Cybersecurity Framework 2.0 so that response is part of normal risk management rather than a separate emergency.

In India the clock matters. The CERT-In directions of 2022 require listed incidents to be reported within six hours of being noticed and logs to be kept for 180 days. The Digital Personal Data Protection Act 2023 adds breach notification duties for personal data. Good incident response keeps the evidence that these reports and any later case will rest on, instead of wiping it in the rush to recover.

Types of digital evidence

Endpoint Telemetry
Detection and response agent records, Sysmon and process creation events, PowerShell logs and antivirus alerts that show what ran on each host and when.
Authentication Records
Domain controller logs for Kerberos and NTLM authentication, account creations and group changes, VPN and remote access logs and cloud identity sign-in logs with locations and devices.
Network Evidence
Firewall, proxy and DNS logs, NetFlow records, full packet captures where available and intrusion detection alerts that trace the attacker's movement and any data leaving.
Triage Collections
Targeted collections of registry hives, event logs, file system journals, scheduled tasks and persistence locations from many hosts, gathered quickly before full images are possible.
Memory and Disk Images
Full captures of the key systems, the first compromised host, the servers used to move around and any machine where the attacker's tools were found.
Cloud and Application Logs
Audit trails from cloud platforms, email systems, collaboration tools and business applications that record administrative actions, mailbox rules, sharing and exports.
Attacker Artefacts
Tools, scripts, ransom notes, web shells, created accounts and archives staged for exfiltration, each hashed and preserved as found.
The Response Record
The team's own log of what was observed, decided and done, with times, which becomes evidence of the organisation's conduct and the basis of the report.

Devices and data sources

Workstations, servers and domain controllers across the affected environment
Firewalls, proxies, VPN concentrators and DNS servers
Security information and event management platforms and log archives
Cloud tenants, including identity, storage, email and audit services
Backup systems, which hold both clean restore points and evidence of when the attacker touched them
Email gateways and mailboxes where phishing began
Third-party providers and managed service partners whose access was used
People, through interviews with the staff who noticed, clicked or responded first

How an examination runs

The order matters. Each step protects the one after it.

01
Prepare
Before anything happens: know the systems, keep logs for at least the legally required period with synchronised clocks, write a plan with roles and contacts, agree who can authorise shutdowns and keep trusted tools and media ready.
02
Detect and Triage
Confirm that the alert is real, estimate the scope and severity and open the response record. Decide at once what must be preserved before any clean-up begins.
03
Preserve Under Pressure
Capture memory on key systems, snapshot virtual machines, export logs before they roll over and keep ransom notes and attacker files. Isolate rather than power off where memory matters. Nothing is reinstalled until it is imaged or a documented decision says otherwise.
04
Analyse and Scope
Build the timeline from the first sign backwards to the entry point and forwards to every system touched. Identify the accounts, tools and routes used and whether data left the network.
05
Contain
Cut the attacker's access without alerting them more than necessary: block addresses, disable accounts, reset credentials, segment networks. Record every action with the time and the person who authorised it.
06
Eradicate and Recover
Remove persistence, rebuild compromised systems from known-good sources, restore data from backups verified as clean and monitor for the attacker's return before declaring the environment restored.
07
Report and Notify
Meet the reporting duties, CERT-In within six hours of noticing a listed incident, data protection notifications where personal data was affected and any sector regulator, insurer and law enforcement reports, using the preserved evidence.
08
Learn
Hold a post-incident review that records what worked, what failed and what changes follow, and feed the indicators and lessons into detection and preparation.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Incident: An event that threatens the confidentiality, integrity or availability of systems or data. Not every alert is an incident, and the decision to declare one starts the formal process.
Triage: The fast first assessment of an alert or a host to decide whether it is affected and how urgently, before any deep examination.
Containment: Actions that stop the incident spreading or continuing, from isolating a host to disabling an account. Short-term containment buys time, long-term containment holds until eradication.
Eradication: Removing the attacker's access and tools completely, which depends on knowing the full scope first.
Dwell Time: The period between the attacker's first access and their discovery. Long dwell times mean more systems touched and more logs needed.
Indicator of Compromise: A hash, address, domain, account or pattern that identifies the attacker's activity, used to sweep the rest of the environment.
Lateral Movement: The attacker's progress from the first compromised system to others, usually through stolen credentials and remote administration tools.
Exfiltration: The removal of data from the environment. Proving or disproving it is often the hardest question in a breach and the one that decides notification duties.
Playbook: A written procedure for a specific incident type, such as ransomware or business email compromise, so that the team acts in a tested order under stress.

Challenges and limits

What makes it hard

Recovery pressure pushes teams to wipe and rebuild before evidence is preserved, destroying the answer to how the attacker got in
Logs are often missing, too short or never enabled, so the scope stays uncertain and notification decisions are made without facts
Attackers delete logs, backups and shadow copies and may still be watching the response through compromised accounts
Six-hour reporting and data protection deadlines arrive before the facts are clear, and the first report must be honest about uncertainty
Cloud, remote work and third-party access spread the evidence across providers and jurisdictions with their own processes
Proving that data did not leave is far harder than proving that it did, and absence of evidence is often all the logs offer
Legal privilege, insurance requirements and public communication can pull in different directions from the technical work

Keeping the evidence intact

Open a response record at the first alert and log every observation, decision and action with the time and the person
Preserve before you change: capture memory, snapshot and image key systems and export logs before any containment that would alter them
Hash every collected item and keep attacker artefacts in protected containers with a handling log
Use trusted tools and accounts for the response, since the attacker may control the usual ones
Keep the chain of custody for anything that may go to law enforcement, a regulator or a court, from the first day

Standards and legal considerations

NIST SP 800-61 Rev. 3
Incident Response Recommendations and Considerations for Cybersecurity Risk Management, the 2025 revision that aligns incident response with the Cybersecurity Framework 2.0 functions.
NIST SP 800-86
Guide to Integrating Forensic Techniques into Incident Response, which explains how evidence is collected and examined inside the response process.
Read the guide
ISO/IEC 27043:2015
Incident investigation principles and processes, from readiness through analysis to closure.
Read the guide
CERT-In Directions 2022
The Indian directions on six-hour incident reporting, 180-day log retention, clock synchronisation and the duties of service providers.
Read the guide
DPDP Act 2023
The Digital Personal Data Protection Act, whose breach notification duties apply when personal data is affected by an incident.
Read the guide

In practice

Ransomware at a Trading Firm
Staff arrive to find servers encrypted. The response lead stops the IT team from reinstalling, snapshots the virtual machines, captures memory on the domain controller and exports the firewall logs. The timeline shows a VPN login with a stolen password five days earlier, a tool for archiving files on the file server two days before encryption and an upload to a cloud storage address, which decides the breach notifications. The CERT-In report is filed within the six hours with what is known and updated later.
Payment Diverted by a Mailbox Rule
A supplier's invoice is paid to a wrong account. The email audit log shows a sign-in to the accounts manager's mailbox from an unfamiliar location two weeks earlier, a forwarding rule created the same day and the attacker replying from the mailbox with new bank details. Containment resets the credential and removes the rule, and the preserved log becomes the bank's and police report's core evidence.
The Alert That Was Not an Incident
A monitoring tool flags an administrator's late-night logon to a server. Triage finds a scheduled maintenance ticket, matching change records and no other activity. The team records the check and closes the alert without declaring an incident, which is itself a correct outcome of the process.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.IntermediateMalware Analyst

MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.IntermediateMalware Analyst

NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.IntermediateDCNI

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

Standards for this area

Careers that use it

Questions people ask

Should we shut down infected machines?

Usually isolate rather than shut down. Disconnecting the network stops the spread while keeping memory, which may hold the attacker's tools and keys. Shut down only when a documented decision says the risk of leaving it on is greater, and capture memory first where possible.

What must be reported to CERT-In and when?

The 2022 directions list the incident types that must be reported, including ransomware, data breaches and attacks on critical systems, within six hours of noticing them. The first report can state what is known so far. This page is educational, and the organisation's legal advisers decide the exact duties in each case.

Can we restore from backup straight away?

Only after the backups are checked for the attacker's access and the entry point is closed. Restoring onto a still-compromised network means being hit again. The backup system is also evidence, since attackers often disable or delete backups before encrypting.

Do we need a forensic laboratory for incident response?

You need forensic discipline: preservation, hashing, documentation and custody. Much of the response is done by the organisation's own team or its provider, with full examinations of key systems passed to specialists when the case, the regulator or the court requires it.