Digital Forensics.
We secure evidence and determine the cause, scope and perpetrator of an attack.
Digital forensics establishes what happened in an attack.
What is digital forensics?
Digital forensics helps investigate cybercrime and secure evidence.
Digital forensics experts secure and analyze digital traces.
Why digital forensics matters.
Digital forensics lets companies respond quickly to cyberattacks. It secures evidence that can be used for criminal prosecution and claims for damages. Analyzing the evidence helps identify the perpetrators and understand the cause of the attack. This limits the damage and helps you prevent further attacks.
What we secure and analyze.
Our forensics experts secure all relevant data, such as logs, files and system images. From this data, we determine the type of attack and the extent of the damage. We then identify the attackers and produce detailed reports that can be used in court.
Our security experts follow a process model based on international standards and best practices: preparation, data collection, examination, data analysis, documentation and optional follow-up.
If needed, our experts also support you with incident response and crisis management to deal with the consequences of a cyberattack.
Digital forensics secures attackers’ traces so that they are admissible in court.
The digital forensics process
in six phases.
Strategic and operational preparation
We discuss the initial situation with you and explain our approach. Depending on the incident, we select the appropriate forensic tools.
Data collection
In this phase, we collect important data from potentially affected components. This includes, for example, system time and date, active processes (system state), open network connections (sockets) and logged-in users.
Examination
We examine the collected data and filter out what is relevant to the incident. Some data can be excluded from further analysis (e.g. based on unchanged checksums). However, it may also be necessary to extend the analysis to additional parts of the IT environment.
Data analysis
We link the findings from all affected components and combine them into one continuous timeline.
Documentation
Our IT forensic specialists summarize the logged steps of the investigation in reports. Each report is tailored to its audience. The management report contains different technical details than the report for administrators. If authorities need to be notified, we help you draft the notifications.
Follow-up (optional)
On request, once the incident has been handled, we look for possible vulnerabilities. We recommend measures to prevent future attacks and help you improve your company’s response strategy (the process for responding to incidents).
What else helps.
Penetration testing
We simulate attacks on your IT infrastructure and find vulnerabilities before real attackers do.
Cybersecurity Incident Response
When a security incident hits, we help you stay calm and take the right steps in the right order.
Mobile forensics
We recover digital traces from smartphones, tablets and IoT devices and analyze them for use in court.
Need support with digital forensics?
Or with incident response? Then contact us today. We will gladly help you deal with a cyberattack.
Book a meeting