Digital Forensics.
Secure evidence and identify the cause, the scope and the perpetrator of the attack.
Fast and effective investigation with digital forensics.
What is digital forensics?
Digital forensics plays a central role in investigating cybercrime and securing evidence of criminal offenses.
Digital forensics experts secure and analyze digital traces.
Why digital forensics matters.
Digital forensics enables companies to respond quickly and effectively to cyberattacks. It secures evidence of a cyberattack that can be used for criminal prosecution and claims for damages. Besides identifying the perpetrators, analyzing the evidence makes it possible to understand the cause of a cyberattack and take measures to prevent further attacks. This minimizes the impact of an attack, limits the damage and turns the insights gained into a way to prevent future attacks.
Structured. Reliable.
Our digital forensics experts secure all relevant data, including logs, files and system images. We analyze the collected data to determine the type of attack and the extent of the damage. We then produce detailed reports that can be used in court, and we identify the attackers.
Our experienced security experts carry out forensic investigations according to a process model based on international standards and best practices: preparation, data collection, examination, data analysis, documentation and optional follow-up.
In addition, our experts can support you with incident response and crisis management to deal with the consequences of a cyberattack.
Digital forensics secures attackers’ traces so that they are admissible in court.
The digital forensics process
in six phases.
Strategic and operational preparation
We discuss the initial situation with you and explain our approach. Depending on the incident, we select the appropriate forensic tools.
Data collection
In this phase, we collect important data from potentially affected components. This includes, for example, system time and date, active processes (system state), open network connections (sockets) and logged-in users.
Examination
The collected data is now examined and the data relevant to the incident is filtered out. Some data can be excluded from further analysis (e.g. based on unchanged checksums). However, it may also be necessary to extend the analysis to additional parts of the IT environment.
Data analysis
The findings from the individual examinations of the various affected components are integrated into a coherent timeline and logically linked.
Documentation
Our IT forensic specialists summarize the logged steps of the investigation in reports. These are tailored to the respective audience: the management report contains different technical details than a report for administrators. If authorities need to be notified, we help you draft the corresponding reports.
Follow-up (optional)
Optionally, once the incident has been handled, we identify possible vulnerabilities. We recommend measures to prevent future attacks and help you improve your company’s response strategy (the process for responding to incidents).
What else helps.
Penetration testing
Simulated attacks on your IT infrastructure — uncover vulnerabilities before real attackers do.
Cybersecurity Incident Response
Professional handling of cybersecurity incidents — stay calm, take the right steps in the right order.
Mobile forensics
Smartphones, tablets, IoT — recovery & court-proof analysis of digital traces.
Need support with digital forensics?
Or with incident response? Then contact us today. We will gladly help you deal with a cyberattack.
Book a meeting