Endpoint forensics is the examination of laptops, desktops, and servers to identify and interpret signs of activity, compromise, or misuse. Investigators may analyze files, system logs, running processes, browser records, and other artifacts to understand what happened on a device.
In cyber security, endpoint forensics supports incident response by helping teams determine scope, reconstruct activity, and preserve evidence for later review. Fleet-scale investigations prioritize rapid, repeatable collection across many systems, while evidence intended for formal proceedings also requires careful documentation, integrity checks, and a clear chain of custody. Responders should use methods suited to the investigation and preserve collected data so findings can be reviewed.