A forensic window is the period when evidence of a security incident remains available to collect and examine. It can be shortened when attackers delete logs, overwrite files, or restore altered systems, and when routine log rotation or limited retention removes records.
This matters because a clean-looking system after an incident does not prove it was never compromised. In a brief software supply-chain tampering event, server content may have been restored before investigators inspect it. Defenders can extend the forensic window by preserving logs and snapshots, retaining endpoint and network telemetry, and recording relevant activity in centralized systems. These independent records can help establish what happened even after the original system has changed.