The Forensic Investigation Process After a Cyber Incident

Step One: Confirm and Scope

Forensics starts by confirming an incident actually occurred and getting a rough sense of its scope before deciding how aggressively to act. Moving to full remediation before this step can accidentally destroy the evidence needed to understand what happened.

Step Two: Preserve Evidence Before Remediating

Chain of custody matters here. Investigators work to preserve evidence, including capturing volatile data like RAM, active network connections, and running processes, before anything gets powered down or wiped. This is a direct reason why “just shut it all off” is not always the right first move, even though it feels protective.

Step Three: Collect the Artifacts

The team collects disk images, logs, network data, and cloud artifacts, including Windows Event Logs, firewall and VPN logs, cloud audit trails, and endpoint detection and response (EDR) logs. This is the raw material used to reconstruct what happened.

Step Four: Reconstruct the Timeline

From those artifacts, investigators build a timeline of the attack, identifying the entry point and tracing any lateral movement through your systems, meaning how far the attacker got once they were in.

Step Five: Identify the Vector and the Data Accessed

The investigation identifies how the attacker got in, commonly phishing, stolen credentials, or an exposed service, and what data they actually accessed or exfiltrated. This finding drives your notification obligations: what you are required to disclose, and to whom, depends directly on what the forensics team confirms was accessed.

Why This Work Takes Time

A thorough investigation is what your legal notification deadlines and your insurance claim both depend on. Rushing this step risks getting the scope wrong, which can mean under-notifying people who were actually affected or over-notifying in a way that creates unnecessary alarm and cost.