As it was stated in the previous chapter, digital forensics is an important component of incident response. It is often the application of digital forensic methods that allows incident responders to gain a clear understanding of the chain of events that led to a malicious action, such as a server compromise or other data breach. For other incidents such as internal fraud or malicious insider activity, digital forensics may provide the proverbial smoking gun that points to the guilty party. Before a detailed examination of the tools and techniques available to incident responders, it is critical to address the foundational elements of digital forensics. These elements provide not only context to specific actions, but also a method to ensure that the evidence made part of an incident investigation has utility.