Forensics

Roles: investigator, suspect, evidence, crime-scene, chain-of-custody, trace, reconstruction, testimony

The systematic investigation of past events through physical and documentary evidence. The forensic frame is distinguished from surveillance (which watches in real time) by its temporal orientation: forensics works backward from traces to reconstruct what happened. The investigator does not observe the event but infers it from the evidence it left behind. This frame maps onto incident response, audit analysis, and any domain where understanding requires reconstructing a causal sequence from fragmentary after-the-fact records.

As Source Frame (1)

• Audit Trails Are Forensic Footprints → network-security