The practice of collecting, preserving, analyzing, and presenting digital evidence in a manner that is legally admissible and defensible in court proceedings, used to investigate and resolve incidents involving computer systems, networks, and digital devices.