Incident response (IR) is equal parts firefighter (containing and remediating a breach as quickly as possible while minimizing damage) and investigator (figuring out what exactly happened, how, from where, and why) Without a root cause analysis, similar breaches can and often do simply reoccur. With law enforcement, digital forensics has become more commonplace as more crime moves online, and increasingly relevant even with offline crime to help corroborate physical evidence and support key elements of a prosecution, like a criminals intent, location, or state of mind.”]