A key component of incident response is digital forensics, which involves building a timeline of system activity to correlate file changes with network connections.

“Then you use tooling uh like you build a timeline of all the files that have been created, modified, accessed on the disk and you you correlate that with the time of connection to the commander control server and say okay what files were created or touched uh around the time that the connection star”