Incident response (IR) primarily focuses on analyzing digital evidence to understand ongoing or past events.