DFIR stands for Digital Forensics and Incident Response. It is the discipline of finding, preserving, analyzing, and reporting digital evidence after a security event, while also containing and eradicating the threat. DFIR work must preserve chain of custody and evidence integrity so investigators can trust logs, disk images, memory captures, endpoint artifacts, and timeline data.
In real operations, DFIR is used to determine how an intrusion happened, what systems were affected, and whether attacker actions changed files, accounts, or configurations. It also guides response steps such as isolating hosts, revoking credentials, and collecting volatile data before it disappears. DFIR platforms and tools are themselves high-trust systems, so access control, authentication, and audit logging are critical. If those controls fail, attackers can tamper with evidence, alter settings, or hide their tracks, undermining both the investigation and the wider defense effort.