DFIR

Acronym: Digital Forensics & Incident Response

Capability combining forensic preservation and analysis with incident containment and recovery.

DFIR engagements typically follow NIST SP 800-61r2 for incident response and ACPO guidance for forensic chain of custody.