Incident Response and Digital Forensics
Timeline and Root Cause Analysis
We consolidate all incident evidence into a single timeline and show why the incident was possible. We clearly indicate points not supported by evidence.
What it is
Incident evidence is distributed across systems and time zones. The timeline converts these records to UTC, corrects for system clock drift, and merges them into a single sequence. Root cause analysis identifies the vulnerability or process gap that enabled the attack. For example, the root cause may be a VPN account without multi-factor authentication.
Scope
- Merging endpoint, network, identity, and cloud records into one timeline
- Correcting time zone differences and system clock drift
- Marking each step as evidenced, inferred, or uncertain
- Mapping attacker steps to MITRE ATT&CK techniques
- Identifying the times of first access, detection, and containment
- Reporting the root cause and control gaps that delayed detection
The need
When organizations need it
- When you need to state, based on evidence, when the breach began and when it was detected in notifications.
- When the board asks why the incident was not prevented and what will be done to prevent recurrence.
- When your cyber insurance claim requires a documented technical explanation of the incident.
Method
How we work
-
Gathering sources
We list all evidence and logs, with their source and time zone.
-
Merging
We convert records to UTC, correct clock drift, and merge them into one timeline.
-
Verification
We link each step to at least one piece of evidence. Steps without support are marked as inferred.
-
Root cause
We separately document the vulnerability that enabled the attack and the control gap that delayed detection.
Outcome
What you have at the end
You have a single timeline showing the incident from start to finish, each step backed by evidence. The cause that enabled the attack and the corrective actions to prevent recurrence are clear.
Frequently asked questions
What do you write if the evidence does not show a step?
We mark that step as inferred or uncertain. Missing logs are also a finding and are included in the report with their reason.
Can you perform this analysis if our team collected the evidence?
Yes. We first assess how the evidence was collected and its integrity. If a missing source can still be obtained, we recommend collecting it.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting