Im in thedigital forensics (DF) of the DFIR, the Incident Response (IR) group approach to this action would be very different. How may our actions differ? The (IR) group may be more concerned about when is the next pallet of bananas going to arrive or how does the store quell the panic when only standard bananas are available because of the organics being sold out? In the meantime, Im standing only focused on this pallet, or maybe only the bananas Im holding. My lifetime of eating and cyber training tells me that I am correct, but not limited to many steps in my investigation.