Detection, Response and Intelligence
Incident Response and Digital Forensics
Decisions in the first hours of an incident determine the extent of the damage. Our forensic experts first preserve the evidence. Then they trace the attacker's path from initial access onward. We control the incident along that path and restore systems securely.
Incident Response and Digital Forensics
Data protection laws such as the GDPR require a personal data breach to be reported to the authority within 72 hours. What can be included in that report depends on evidence preserved in the first hours. If evidence is lost, what the attacker accessed may remain unclear.
The need
When organizations need it
- When an unapproved transfer appears in the payment system over a weekend.
- When encrypted files and a ransom note are found on file servers.
- When a forwarding rule that no one created is found in an executive's mailbox.
- When you need to know if a company you plan to acquire has an undetected breach in its network.
Questions
What this work answers
- Where did the incident start, and is the attacker still present?
- Which systems were affected, and which data was exfiltrated?
- Which information in our notifications can be supported by evidence?
- In what order can we safely restore systems?
Incident Response and Digital Forensics
What we do
-
Cyber Incident Response
Our experts work with your team throughout the incident. Every response decision is based on collected evidence and your business priorities.
-
Incident Response Readiness Assessment
We clarify decision-makers for incidents in advance. We assess how far your logs go back and whether backups are accessible.
-
Incident Response Retainer
Contract, access path, and evidence collection method are prepared before an incident. No time is spent on these discussions during an incident.
-
Disk and System Forensics
From disk images and system logs, we determine which actions the attacker took and when.
-
Memory Analysis
A memory image is taken before shutting down the system. Malicious code not written to disk and active connections are analyzed in this image.
-
Cloud and Identity Incident Investigation
From cloud audit logs and sign-in records, we determine which identity accessed what.
-
Malware Analysis
We determine what the malware found in the incident does and where it communicates. We also show how to search for it on other systems.
-
Business Email Compromise Investigation
We track which messages in the compromised account were read or forwarded. We show how the fraudulent payment instruction was prepared.
-
Ransomware Incident Analysis
We identify the entry point and spread path. We show whether data was exfiltrated before encryption and which backup is safe.
-
Timeline and Root Cause Analysis
We consolidate all evidence into a single timeline. Points not supported by evidence are clearly marked as uncertain.
-
Eradication and Recovery
We remove persistence mechanisms and compromised credentials. Systems are restored in dependency order and monitored.
-
Compromise Assessment
We search for signs of an undetected breach when no incident is known. This is done before an acquisition or after a suspicious indicator.
Scope
During an incident, the scope starts with affected systems and expands as evidence directs. Readiness and compromise assessment work are limited to the systems and period you define.
How we work
Evidence is preserved first. Memory, disks, and logs are collected unaltered and recorded in the chain of custody. The attacker's path is reconstructed from this evidence. Containment steps follow this path. Eradication is performed in one move after all persistence points are found, preventing early warning to the attacker.
Deliverables
What you receive
A timeline showing the evidence for each step and any uncertainties. A list of affected systems and data. Technical input for regulatory notifications and a chain of custody record. Remediations to prevent reuse of the same path.
NoteYour organization and legal counsel decide whether to notify. We provide the technical findings needed for that decision.
Related services
Schedule Meeting
Tell us your objective and critical systems. We will settle the right scope in the first meeting.
Schedule a Meeting