Containment and preservation
Network isolation without shutdown, acquisition of volatile memory and forensic images of the relevant systems, freezing logs before they rotate and preserving cloud-side evidence.
Service 04
Incident response and digital forensics
In a live incident, the first three decisions determine the total cost: what gets shut down, what gets preserved and what gets communicated. All three are made on incomplete information and under pressure. That is where someone who has been in the room before earns their fee.
Criteria
The three mistakes that multiply the cost
Almost every incident that reaches me late shares the same pattern. It is not a lack of resources: it is the instinctive reaction of a competent team that nobody trained for this particular scenario.
- Powering off the affected machines. Volatile memory is lost, and that is where half the evidence — and sometimes the encryption key — lives.
- Restoring from backup before knowing how the attacker got in. The backdoor is restored along with everything else, and it starts again in three weeks.
- Rebuilding without a forensic image. If the matter ends in litigation or an insurance claim, the evidence no longer exists.
- Notifying before the scope is known. A notification you have to correct later is worse than a justified late one.
Scope
What happens, and in what order
The order is not negotiable. Preservation always precedes eradication, however hard operational pressure pushes the other way.
Phase 1
Phase 2
Analysis and scope
Entry vector determination, full timeline of attacker activity, identification of persistence, lateral movement, compromised credentials and evidence of exfiltration.
Phase 3
Eradication and recovery
A verifiable eradication plan, restoration order, credential rotation and hardening of the specific points the attacker used — not a generic best-practice checklist.
Phase 4
Report and obligations
Technical and executive reports, plus the technical substance your legal counsel needs for notification to the supervisory authority and, where applicable, to data subjects.
Delivery
The clocks that matter
Regulatory deadlines start when the organisation becomes aware of the incident, not when the analysis finishes. That is why the report is built in layers, deliverable as each one closes.
24h
Early warning
NIS2 requires an early warning to the authority within 24 hours for essential and important entities.
72h
Personal data breach
GDPR Article 33 sets 72 hours to notify the supervisory authority from awareness of the breach.
72h
Interim report
Update with scope, confirmed vector and containment measures applied.
30d
Final report
NIS2 sets one month for the final report, with root cause and measures adopted.
—
Closure
Retest of measures, closure record and documented lessons for the response plan.
FAQ
Frequently asked
We have a live incident. What do we do before calling?
Do not power the machines off: isolate them from the network by unplugging the cable or disabling the switch port, which preserves memory. Do not restore backups yet. Do not delete anything, including what looks like attacker tooling. Write down the time of every action your team has already taken. Then message me with 'live incident' on the first line — those threads are handled outside business hours.
Will the report hold up for insurers and courts?
It is written for exactly that. Acquisition is documented with chain of custody from the first minute, with verification hashes and a record of every action, so the same material supports an insurance claim, a regulatory notification and, if needed, an expert report ratified in court. That is the advantage of the incident responder also being a court-appointed expert witness.
Can you tell whether data was stolen?
Sometimes with certainty and sometimes only with degrees of confidence, and it has to be stated that way. With retained network, firewall or proxy logs, exfiltrated volume can be quantified and often identified. Without them, you work from host artefacts — archiving utilities, scheduled tasks, cloud storage client remnants — and the conclusion is labelled an indication, not a proven fact. I never assert what I cannot defend.
Which one fits your case?
Describe the environment and the reason behind the engagement. I will reply with the recommended mode and an estimated order of effort.