Collecting and analyzing digital and physical evidence to determine the cause and scope of a security incident or breach.