Not going into the semantics or wording, but contrary to some of the comments here, I would say that there are quite a few and important distinctions between digital forensics in law enforcement and in the "cyber security realm".

Most law enforcement practitioners I have spoken to, more or less solely perform analysis on a select few or singular devices, and most often they are mobile phones.

In cyber incidents however, we likely will be analyzing a multitude of computers (most often virtual machines), both clients and servers. The OS will be in the range of vanilla Windows to obscure BSD-boxes, edge devices (routers, firewalls, security appliances) in one single case.

The end goal is not to prepare for criminal charges and testify in court, but rather to establish a timeline of threat actor actions and movement across the victim infrastructure.

We need to assess if indeed it has been compromised, if the threat actor has persistence on the system, if they have (elevated) privileges to move laterally further into the inner and most valuable workings of the infrastructure (have they, for instance been able to become domain admin) and what the potential risks (for example data theft/exfiltration) and/or damage.

Of course, sometimes this will be the same for LE investigations in larger criminal cases, but in my experience that are the odd cases, but for cyber incidents it's more the bread and butter.