DFIR
Digital Forensics and Incident Response
Digitale Forensik und Reaktion auf Sicherheitsvorfälle
The combination of forensic preservation and incident handling in one procedure, so that containment and later provability do not destroy each other.
Incident response wants to limit damage fast; forensics wants traces left untouched. Both succeed only if the order is right: preserve volatile data first, then isolate, then clean up. DFIR is that discipline – every action logged, evidence secured before intervention. The Network and Information Security Directive 2 (NIS2) reporting deadlines of 24 and 72 hours presuppose exactly this.