There is sometimes a difference of opinion as to where the practice of digital forensics belongs in terms of occupational domains. Some say that it is a forensic science domain, other say that it is a cybersecurity domain. I believe it can be both, depending on what the end use of the digital forensic process is. Nowhere is this truer that in incident response. Incident response is generally a well understood process where organisations response to an information security incident, and there are often competing priorities in what is needed to be done. Regardless of which priorities are pursued within the organisation, the reality is that various digital forensic techniques and methods are often used, and depending on the end use case, will either see digital forensics in incident response either fall into forensics science, cybersecurity (in the form of forensic engineering), and even both. This presentation will explore the differences between how digital forensics is used when applied towards a forensic science goal, or a forensic engineering goal, in incident response.
