Investigative and forensic activities conducted after a security incident to reconstruct the attack timeline, identify compromise vectors, assess impact, collect digital evidence, and produce lessons learned. Includes digital forensics, malware analysis, log correlation, and root cause analysis.