Digital forensics, eradication and recovery after an incident
Understand incident evidence, eradication, business continuity and disaster recovery, and how they support one another.
A security incident can interrupt operations and raise questions about what happened, whether an attacker still has access, and how to restore services safely. Forensics, eradication, continuity and recovery address related but different needs. They can overlap rather than proceeding as a rigid sequence.
## What is digital forensics?
Digital forensics is the collection, preservation, examination and analysis of digital evidence to answer questions about events involving computers and other digital systems. Evidence might include logs, disk images, cloud audit records or volatile memory; relevance and retention depend on the incident. Record where evidence came from, when and how it was acquired, who handled it and any integrity checks. Work within applicable authority, privacy rules and legal requirements; some situations need qualified specialists. [NIST SP 800-86](https://csrc.nist.gov/pubs/sp/800/86/final) describes integrating forensic techniques into incident response.
A suspicious log entry is a clue, not necessarily proof of compromise or attribution. Preserve useful evidence before destructive cleanup when practicable, but coordinate with responders: delaying urgent containment can increase harm. An organization should make these tradeoffs in its incident plan.
## What is eradication?
Eradication is the effort to remove the identified cause and attacker footholds after or alongside containment. Depending on evidence, this may include removing malicious components, revoking compromised credentials, closing an exploited path and rebuilding affected systems from trusted sources. Containment limits ongoing harm; eradication addresses identified mechanisms that could sustain or renew it. A patch alone does not establish that all unauthorized access has been removed. Continue monitoring and verify actions against the incident's known scope.
[NIST SP 800-61 Revision 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) places incident response within broader cybersecurity risk management. Response activities depend on the event and may be repeated as investigators learn more; no checklist proves every attacker has been found.
## Business continuity and disaster recovery
Business continuity is the ability and planning needed to sustain critical business activities through disruption. A continuity plan can include alternate staffing, communication, suppliers and temporary manual work. Disaster recovery focuses on restoring technology and services after a major disruption. The plans should coordinate, but they are not synonyms: a restored server does not alone prove that the business process depending on it is functioning.
[NIST's business continuity plan glossary](https://csrc.nist.gov/glossary/term/business_continuity_plan) and [disaster recovery plan glossary](https://csrc.nist.gov/glossary/term/disaster_recovery_plan) provide definitions in the context of their source publications. Identify service owners and dependencies, acceptable interruption and data loss, and restoration priorities before an incident. Test the plan and verify restored data and access; a backup that has not been successfully restored in a test is not proof of recovery.
## Putting the work together
For an exposed application, responders might isolate an affected service, preserve relevant records, investigate how access occurred, remove identified access and restore from a trusted version. Teams may use temporary business procedures while checking the restored service and monitoring for recurrence. Document decisions and revisit assumptions as evidence changes. See [our ransomware preparation guide](https://blog.mithril.fund/what-is-ransomware?lang=en) for backup and containment considerations. Sources reviewed on 2026-10-30.