Forensic analysis reconstructs events from evidence — building a timeline, identifying attacker actions, determining scope of compromise, and attributing activity.
Tools: Autopsy (disk forensics), Volatility (memory), Wireshark/Zeek (network), SIEM (log correlation). Artifact types: prefetch files (Windows execution evidence), browser history, registry (persistence), event logs. Timeline analysis is the core forensic methodology.