Reconstruction is the forensic rebuilding of an incident's timeline, establishing what happened, in what order, and with what effect. It assembles evidence from many sources into a coherent sequence so the organization can understand the full scope of the event and support any reporting or legal obligations that follow.
Within the Post-Incident phase, reconstruction gives assessment and improvement their factual backbone. A reliable timeline turns scattered artifacts into a narrative that shows how the adversary entered, what they did, and how far they reached. That narrative is essential for accurate impact judgments and for decisions about disclosure.
In practice, reconstruction follows the forensic process of collection, examination, analysis, and reporting. Investigators preserve evidence with attention to integrity and chain of custody, examine disk, memory, log, and network artifacts, correlate timestamps across systems, and interpret the combined picture. The findings are documented clearly enough to withstand scrutiny, whether by internal leadership, regulators, or courts. Careful reconstruction also strengthens future readiness, since it reveals exactly which data sources were available and which were missing when they were needed most.
References#
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response
- SANS, Digital Forensics and Incident Response resources