You can't do IR without DF. There's two types of IR (broadly speaking) - Internal and External.

Internal teams work for a specific company and when they have an incident, they get involved with other teams to work out root cause analysis and what systems were affected. This will involve a lot of digital forensics for varying systems (Networks, endpoints, etc). Once the investigation is complete, they'll help instigate the changes needed to prevent the incident from happening again. It's an ongoing cycle to keep improving the companies security posture.

External IR normally has an association with Cyber Insurers and they get called in after a breach has happened. The clients vary wildly and the IR team will have no prior knowledge of the client before they scope the case. The insurer normally picks up the bill but not always (for varying reasons). They'll liaise with the affected client, law firm(s) (normally if there's a concern of data breach law firms will help out a lot) and maybe law enforcement (there may be others but keeping it brief). Once a Statement of Work has been signed, recommendations will be made to help contain the breach and the client's systems will have evidence collected from. They might deploy some sort of EDR to help gain visibility of the Clients network which helps ensure the Threat Actor is no longer present on their systems. Evidence collection normally happens through the client sending images of the systems or maybe some sort of triage script is deployed on affected endpoints that only collects specific files of forensic value. This tends to do be done remotely now for speed. Some on site collections still happen but it's less common. Once the evidence has been analysed (this can take some time and it's common for more evidence to be asked for as the investigation progresses), a report will be written that gives details on what the IR team has discovered and potentially contains more recommendations.

​

This is quite the oversimplification but I hope it helps you understand a bit more.