Topic hub
Digital forensics (DFIR)
Definition
Digital forensics and incident response (DFIR) — Digital forensics and incident response (DFIR) is the combined discipline of collecting and analysing digital evidence to establish what happened during a cyber attack, and managing that attack end to end.
The evidence that answers the hardest questions is the evidence that disappears first. This hub covers how forensic investigations are actually run — what gets collected, in what order, and under what chain of custody — and the open-source tooling we built because the commercial options did not cover the case in front of us.
Order of volatility
Evidence is collected most-volatile first, because each step risks destroying what comes before it. Memory and running process state vanish on shutdown. Network connections and ARP caches turn over in seconds. Temporary files and swap survive slightly longer. Disk, logs and archived backups persist longest. An acquisition that starts with a disk image and gets to memory afterwards has already lost the memory.
Chain of custody
Evidence only carries weight if you can show it has not changed since collection. That means cryptographic hashing at the moment of acquisition, a documented record of every person who handled it and when, and working on copies rather than originals. Our own tooling — MAES for Microsoft 365, Forti-DFIR for Fortinet environments, the DO Audit Log Scraper — hashes at extraction time for exactly this reason.
Where the evidence lives now
Forensics used to mean disk imaging. Increasingly the artefacts that matter are in places that have no disk at all: SaaS audit logs with short retention windows, cloud control-plane events, container runtimes that are destroyed on redeploy, and AI agent runtimes where the reasoning trace exists only in transit. Each of these needs its own acquisition method, and most need it configured before the incident.
Open-source tooling
M365 forensics
MAES
The M365 Analyzer & Extractor Suite — extract, analyze and preserve evidence from Microsoft 365 tenants with SHA-256 chain of custody.
Fortinet forensics
Forti-DFIR
Open-source framework giving security teams the tooling they need for forensic investigations and incident response in Fortinet environments.
Prevention
RansomProtect
Detects and blocks ransomware and wipers early in the infection chain, where built-in OS defenses fall short.
Cloud posture
FlareInspect
CLI assessment framework for evaluating and monitoring an organization’s Cloudflare security posture.
Evidence capture
DO Audit Log Scraper
Chrome/Chromium extension enabling forensic-grade audit log extraction. Now at v2.0.
Compliance
Tikun13 Checker
Browser-based open-source checker helping Israeli organizations implement the requirements of Amendment 13 to the Privacy Protection Law.
Everything we have published on digital forensics (dfir)
12 pieces of research, tooling and case-study work.
Common questions
What is DFIR?
DFIR stands for digital forensics and incident response — the combined discipline of collecting and analysing digital evidence and managing an active cyber attack end to end. The two are treated as one practice because the evidence that answers the hardest questions during an incident, such as volatile memory, is the evidence that disappears first.
What is digital forensics?
Digital forensics is the practice of collecting, preserving and analysing digital evidence so that a defensible account of what happened on a system can be produced. It requires that evidence is acquired in order of volatility, hashed at the point of collection, and handled through a documented chain of custody.
What is the order of volatility in digital forensics?
The order of volatility ranks evidence by how quickly it disappears, and dictates the order of collection: CPU registers and cache first, then memory, then network state and running processes, then temporary files and swap, then disk, then logs and archived backups. Collecting out of order risks destroying more volatile evidence in the process of gathering less volatile evidence.
What is chain of custody in digital forensics?
Chain of custody is the documented record showing who handled a piece of digital evidence, when, and what was done to it, together with cryptographic hashes proving it has not changed since acquisition. Without it, evidence cannot be relied on in a legal, regulatory or insurance context, however sound the technical analysis is.
Can digital forensics be performed remotely?
Yes. Forensic acquisition, including volatile-memory capture, is routinely performed remotely, which is what makes fast response times achievable regardless of where the affected systems sit. On-site work is reserved for environments that cannot be reached remotely, such as some air-gapped OT networks.
What open-source DFIR tools does IONSEC publish?
IONSEC publishes and maintains six open-source DFIR tools: MAES for Microsoft 365 evidence extraction with SHA-256 chain of custody, Forti-DFIR for Fortinet forensics, RansomProtect for ransomware and wiper prevention, FlareInspect for Cloudflare security posture, the DO Audit Log Scraper browser extension for forensic-grade audit log capture, and Tikun13 Checker for Israeli Amendment 13 privacy compliance.
How we help
Emergency Incident Response
24/7 emergency incident response with an assured four-hour response from first contact — containment, full attack-chain reconstruction, and guided recovery.
T3aaS — Tier 3 as a Service
On-demand senior escalation for your SOC: threat hunting, malware analysis and reverse engineering, and detection engineering, without carrying the headcount.
Related topics
Incident response
Incident response is the structured process an organization follows to detect, contain, eradicate and recover from a cyber attack, and to establish how the attacker got in and what they accessed.
AI security
AI security is the practice of securing artificial intelligence systems — models, agent runtimes and the tooling they invoke — against attack, and of investigating incidents in which those systems are the target or the means.
Talk to the team that does the work
The people who publish the research above are the people who take your escalations.