Reconstructing a dataset after detection of a network security threat in a network

A system, comprising:

• one or more processors;
• and
• a memory comprising a plurality of program instructions which, when executed by the one or more processors, cause the one or more processors to:
• in response to a network security threat for a network, determine a plurality of paths through which data associated with the network security threat has passed to a destination dataset within the network, comprising determining the plurality of paths using one or more tracing operations;
• determine an amount of the data associated with the network security threat to be returned to a plurality of datasets of the plurality of paths, wherein the plurality of datasets comprises one or more source datasets from which the data originates;
• generate a forensic report based on the determined amount of the data associated with the network security threat to be returned to the plurality of datasets;
• and
• output the forensic report.

A non-transitory computer-readable medium having stored thereon a plurality of computer-executable instructions which, when executed by a computer, cause the computer to:

• in response to a network security threat for a network, determine a plurality of paths through which data associated with the network security threat has passed to a destination dataset within the network, comprising determining the plurality of paths using one or more tracing operations;
• determine an amount of the data associated with the network security threat to be returned to a plurality of datasets of the plurality of paths, wherein the plurality of datasets comprises one or more source datasets from which the data originates;
• generate a forensic report based on the determined amount of the data associated with the network security threat to be returned to the plurality of datasets;
• and
• output the forensic report.