Forensic examination: The methodical collection and analysis of digital evidence to reconstruct past events. This can include activities like recovering deleted files, analyzing system logs, extracting data from databases, or examining network traffic. The goal is to understand what actions were performed, by whom, and when to establish the facts of a case or incident.