Ever wonder what truly happens after a security incident, especially when it involves the law? This lecture pulls back the curtain on the world of ICT court expert witnesses and the formal process followed by prosecutors and courts. Go beyond the dramatized TV shows and dive into digital forensics in action, seeing firsthand how evidence is meticulously discovered and correlated to reconstruct the narrative of an attack. We'll explore real-world examples from Bosnia and Herzegovina, discuss the tools of the trade and their limitations, and highlight the essential knowledge, skills, and competencies required for this critical field. While the process is far from the glamour of CSI, this engaging and easy-to-follow lecture will provide invaluable insights into the realities of forensic investigation.