Digital forensics
Evidence collection and analysis after a security incident — what happened, when, how far did the attacker get.
Techniques: memory dumps, disk images, log analysis, malware reverse engineering. Chain of custody is critical if evidence might be used in court. Tools: Volatility, Autopsy, FTK. Closely related to incident response.