Digital forensics
Collecting and analyzing evidence from affected systems to establish what an attacker did and what they reached.
Forensics answers the questions that determine your legal position: how they got in, how long they were there, what they accessed, and whether data left. Those answers drive notification obligations and insurance claims.
It depends on evidence surviving. Logs with short retention, machines reimaged in a hurry, and cloud audit data that expired all narrow what can be established, which frequently forces the cautious assumption that everything was exposed.
Where this comes up
Digital forensics sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.