Digital Forensics Investigation involves the collection, preservation, and analysis of digital evidence from compromised systems, including endpoints, servers, and cloud environments. The investigation reconstructs attacker activity timelines, identifies affected assets, and determines data exposure or manipulation. Forensic processes follow industry-accepted methodologies to ensure evidence integrity, chain of custody, and admissibility where required.