In information security terms, a method of data analysis and investigation performed after an intrusion has already occurred.