It covers disks, memory, logs, network records, cloud audit trails and mobile devices. The aim is to establish what happened, how, when and what was affected, in a way that others can check. In legal matters, evidence must be handled carefully, with a documented chain of custody.
The order matters. Volatile data, such as what is in memory, disappears when a machine is turned off, so it is collected first. Working on copies, not originals, protects the evidence, and hashes prove that a copy was not altered.
Incident responders use forensics to scope a breach: which systems were touched, which accounts and data were involved and whether the attacker is still there.
Prepare before you need it: keep logs, know who can collect images, keep a written procedure and do not rebuild or wipe a system until the evidence you need has been captured.