After examining log files, conducting interviews, and inspecting the database server, firewall, and web server, the team concludes that Widgets, Inc. has suffered a breech and was most likely a victim of a SQL injection attack. Reconstructing the attack is part of what phase of incident respones