Incident response and digital forensics
Contain the incident, find the root cause and preserve evidence that stands up.
- Initial response and containment
- Forensic imaging
- Forensic analysis
- Fraud investigation
- Recovery support
- Evidence archival
What it is
A security incident can stall a business and damage its reputation. A prompt, well-run response limits the spread, establishes what happened, avoids alerting the intruder and preserves first-hand evidence.
Evidence must be collected, transported and stored according to legal guidelines so it remains usable by regulators and law enforcement. Our approach uses forensic imaging with hardware write blockers and secure archival of digital artefacts.
Our approach
01
Initial response
Determine the type and extent of the incident as far as possible.
02
Strategy
Plan onsite actions without disrupting routine operations.
03
Forensic duplication
Image affected systems with write blockers to preserve evidence.
04
Analysis
Reconstruct the timeline and find the root cause.
05
Recovery and archival
Support recovery and archive evidence securely.
What you receive
- Incident timeline
- Root-cause analysis
- Chain-of-custody records
- Containment and recovery recommendations
- Report suitable for regulators
Standards referenced
ISO/IEC 27037NIST SP 800-61CERT-In Directions 2022
incident-response-and-digital-forensics-report.pdf
Redacted example- 01Incident summary
- 02Timeline of events
- 03Root cause
- 04Evidence and chain of custody
- 05Impact assessment
- 06Recommendations
- Asset
- .
- Issue
- Default credentials on admin console
- Evidence
- CVSS
- 8.8
- Fix
- Change and vault the password; restrict console to the admin network
- Status
- Re-tested: closed