Incident Response and Digital Forensics
Disk and System Forensics
From disk images and system traces, we determine which step the attacker took and when. The findings are based on evidence with demonstrable integrity.
What it is
Disk forensics is performed on an exact copy of a system's storage. The hash of the copy is recorded to show the original was not altered during examination. Operating systems leave traces of which program ran when and which file was accessed. Combined with logs, these traces reconstruct the attacker's actions.
Scope
- Forensic images of server, workstation and virtual machine disks
- Analysis of program execution, logon and file access traces
- Recovery of deleted files and traces the attacker tried to remove
- Detection of compressed archives indicating data staged for exfiltration
- Hash value and chain of custody record for each piece of evidence
The need
When organizations need it
- When a departing employee is suspected of copying the customer list.
- When it is unclear which server the attack started from or where it spread.
- When findings may be required in an internal investigation or legal proceedings.
Method
How we work
-
Acquisition
We acquire the disk copy with write protection and record its hash. In cloud and virtual environments, we use disk snapshots.
-
Chain of custody
We record who, when and how the evidence was collected, following ISO/IEC 27037 principles.
-
Examination
We consolidate traces of program execution, logons and file access into a single timeline.
-
Reporting
We link each finding to its supporting trace. We clearly state what the evidence does not support.
Outcome
What you have at the end
You see what the attacker did on the system, to the minute, with the supporting trace. The evidence is preserved with demonstrable integrity.
Frequently asked questions
Can the findings be used in court?
How the evidence is used is for your legal counsel to decide. We maintain its integrity with hash values and a chain of custody record.
Does the system need to be stopped to copy the disk?
Not always. Copies or snapshots can be taken from running systems and virtual machines without shutdown. We decide together which approach fits the business impact.
Can deleted files be recovered?
Often partially. It depends on whether the file has been overwritten and the disk type. On SSDs, deleted data may disappear more quickly.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting