Cyber incident response and digital forensics

Digital forensics after a cyber incident

When a cyber incident occurs, it is essential to establish as quickly as possible what happened, how far the attack actually reached and whether the attacker is still present in the environment. Through digital forensic analysis we collect and examine digital evidence, reconstruct the course of the incident and give the client the information needed for safe remediation and a return to normal operation.

Digital forensics answers the key questions:

• how the incident came about,
• which systems, accounts and data were affected,
• what changes the attacker made in the environment,
• whether the attacker is still present,
• what the actual damage and residual risk to the organization are.

Based on our findings we produce a forensic report containing an analysis of the incident, containment recommendations and guidance for safely restoring the environment. Where needed we work with the client's IT team or external contractors to plan remediation and to verify that every entry point used in the attack has been closed.

Ransomware response and data recovery

We pay particular attention to the analysis of ransomware attacks. Through digital forensic analysis we establish how the intrusion occurred, the extent of the compromise and what the attacker did, and we assess the consequences of the attack. On that basis we prepare recommendations for safely remediating the environment and evaluate the prospects for recovering data.

It is important to stress that encrypted data cannot be restored without the corresponding decryption key. However, where the attacker did not manage to encrypt everything, or where boot records, partitions or the file system were damaged during the attack so that the disk or operating system will not start, digital forensic techniques can in some cases recover data that was not encrypted. We treat every case individually and give the client a realistic picture of the chances of successful recovery.