Digital and Cyber Forensics

Flow chart of the Digital and Cyber Forensics engagement, 5 phases in order, each one selectable. Phase 1, Engagement and Preservation. We move quickly to preserve volatile and stored evidence before it is lost or altered, and agree the scope and legal considerations with you. Activities: Instruct your team to stop altering the affected systems; Capture volatile memory and live network state first; Secure logs and backups before retention windows expire; Agree scope, legal privilege and reporting lines. Hands over Preservation Notice and Scope Agreement. Phase 2, Acquisition with Chain of Custody. We take forensic images of the relevant systems and media under a documented chain of custody, so every item is accounted for and defensible. Activities: Image disks with a verified write blocker; Hash every image and verify it against the source; Collect cloud and mobile data through documented exports; Log each item handled with time, place and handler. Hands over Chain of Custody Record. Phase 3, Analysis. We examine the acquired data for the artefacts that matter, from logs and files to memory and network traces, following the evidence wherever it leads. Activities: Recover deleted files and examine file system artefacts; Analyse memory images for injected code and credentials; Correlate authentication, endpoint and network logs; Identify malware, exfiltration paths and persistence. Hands over Analysis Findings with Supporting Artefacts. Phase 4, Reconstruction. We build a clear timeline of what happened, in what order and through which actions, separating fact from assumption. Activities: Build the incident timeline from artefacts; Establish the entry point and the attacker's dwell time; Determine what data was accessed, copied or destroyed; State clearly what the evidence cannot answer. Hands over Incident Timeline. Phase 5, Reporting and Expert Support. We deliver a clear, defensible report, and where a matter goes further we support it with expert testimony and evidence you can rely on. Activities: Write findings for both technical and legal readers; Reference every conclusion to its underlying artefact; Brief your counsel, insurer and leadership; Provide expert testimony if the matter proceeds. Hands over Forensic Report. Each phase begins from the artefact the phase before it produced.