DEVELOPMENT AND SIMULATION OF A DIGITAL FORENSICS AND INCIDENT RESPONSE FRAMEWORK FOR SMALL ENTERPRISES

Small and medium-sized enterprises (SMEs) face a growing risk of cyberattacks due to limited technical capacity, budget constraints, and the absence of dedicated cybersecurity teams. Most existing Digital Forensics and Incident Response (DFIR) frameworks, such as those from NIST and ISO, are tailored for large organizations and are often too complex and costly for SMEs to implement. This study addresses this gap by designing and implementing a lightweight, integrated DFIR framework specifically suited for small enterprises. Using the Design Science Research (DSR) methodology, the proposed framework follows a six-phase lifecycle: Preparation, Detection and Triage, Containment, Forensic Analysis, Eradication and Recovery, and Post-Incident Review. The framework leverages open-source tools such as Sysmon, Wazuh, FTK Imager, and Velociraptor to ensure affordability and usability. A simulated SME environment was used to validate the practicality, forensic soundness, and compliance of the framework. Results demonstrate that SMEs can achieve improved cyber resilience and digital evidence integrity using this approach. This research contributes a scalable solution that balances cost, usability, and legal admissibility, ultimately enabling small businesses to respond more effectively to cyber incidents.