DDoS Forensics is the digital forensic process to better understand a DDoS attack.
Forensics can be done for past attacks but also for ongoing attacks. The output of forensics can shed light on the attack vectors, attack tools, and the attacker’s characteristics or identity. The goal of DDoS forensics is to gain visibility that will help you mitigate an ongoing or future attack.
For example, if you realize that the attackers are using the LOIC tool against you, you can expect additional attack vectors that this tool has. In addition, forensics is used in an attempt to locate the attackers, which in DDoS is not an easy task at all.