Ransomware Attack
Systems are encrypted, and data may have been exfiltrated. We determine the entry point, spread and data exfiltration – the basis for rebuilding and for assessing reporting obligations.
Incident Response & Forensics
Digital Forensics: Investigate Incidents, Secure Evidence
Facts, not guesswork.
After a cyberattack or when insider wrongdoing is suspected, reliable facts are what count. With our digital forensics services, we secure digital evidence using recognized methods – remotely or on-site at your premises – reconstruct what happened and document the results in a traceable way.
- 24/7 emergency hotline
- Remote & on-site
- Documented chain of custody
Definition
What Is Digital Forensics?
Digital forensics – also known as IT forensics or computer forensics – is the methodical preservation and analysis of digital evidence to investigate security incidents and crimes. It answers the questions that matter after an incident: How did the attackers get in, which systems and data are affected, how long has the access existed – and who is responsible? We follow the IT forensics guide (“Leitfaden IT-Forensik”) of the BSI (Germany’s Federal Office for Information Security) and the international standard ISO/IEC 27037, which provides guidelines for the identification, collection and preservation of digital evidence. The quality of the evidence preservation determines whether an incident can be proven later.
Forensics provides the basis for key decisions: Which systems need to be rebuilt? Is there a personal data breach that must be reported to the supervisory authority under Art. 33 GDPR without undue delay and, where feasible, within 72 hours – and do affected individuals need to be notified under Art. 34 GDPR? If your organization falls under NIS2, significant incidents must be reported to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) – with an early warning within 24 hours and an incident notification within 72 hours of becoming aware of the incident, plus a final report no later than one month after that notification. We provide the technical facts for this; you make the legal assessment together with your legal counsel. If you wish, we also coordinate with your cyber insurer.
During an acute incident, forensics works hand in hand with incident handling: attackers are locked out without destroying the evidence needed for the investigation and for reports. Learn more under Incident Response & Forensics.
Our Approach
How a Forensic Investigation Works
It starts with a confidential conversation – in an emergency via our 24/7 emergency hotline: What is known, which systems are affected, what is your goal? We secure volatile data such as memory, running processes and network connections first – following the order of volatility described in RFC 3227.
Evidence is secured remotely or on-site at your premises. Remotely, we collect the relevant artifacts from many systems in parallel – ideal for distributed locations and cloud services. On-site, we create bit-for-bit images, using write blockers wherever possible. Hash values prove the integrity of every acquisition, and we document every handover in the chain of custody. Analysis is performed exclusively on copies.
In the analysis, we link traces from clients, servers, cloud services, firewalls and EDR systems into a timeline and map them to MITRE ATT&CK. If needed, we examine any malware we find in more depth through a dedicated malware analysis.
Typical Scenarios
When a Forensic Investigation Is Necessary
Compromised Email Account
Invoices were manipulated or payments redirected. We analyze sign-in and audit logs, forwarding rules and mailbox access.
Suspected Insider
Employees are suspected of taking trade secrets, deleting data or sabotaging systems. We examine endpoints, USB usage, cloud uploads and emails – with due regard for data protection and the works council’s co-determination rights.
Data Exfiltration and Extortion
Data turns up on the dark web or at competitors, or extortionists threaten publication. We determine which data is affected and how it was exfiltrated.
Compromised Servers and Online Shops
An online shop distributes malicious code or a server establishes suspicious connections. We analyze logs, file systems and web shell traces.
Malware on Endpoints
Antivirus or EDR raises an alert, but the scope and cause are unclear. We determine the infection path and extent.
Possible Focus Areas
Our Forensic Services
Not fixed packages, but typical areas of application – we tailor the scope and approach to your case.
After an Attack
Incident Analysis
Investigation of ransomware attacks, business email compromise or compromised servers – closely integrated with containment and recovery.
- Preservation of volatile and persistent evidence
- Reconstruction of how the attack unfolded
- Facts for reports, insurers and rebuilding
Internal Investigations
Investigating Insiders
Discreet investigation when data theft, sabotage or misuse by employees is suspected.
- Coordination with data protection, the works council and legal counsel
- Analysis of endpoints, emails and cloud storage
- Documentation for employment-law and criminal-law steps
Forensic Readiness
Preparing for an Emergency
So that the necessary evidence is available when an incident occurs – in line with module DER.2.2 “Provisions for IT Forensics” of the BSI’s IT-Grundschutz framework. Learn more under Forensic Readiness.
- Review of logging and retention periods
- Evidence preservation guidelines for your IT team
- Integration into the emergency plan and playbooks
Process
Steps of a Forensic Investigation
Based on the BSI’s IT forensics guide and on incident handling guidance such as ISO/IEC 27035 and NIST SP 800-61 Rev. 3.
-
01
First Contact & Initial Indicators
Via the 24/7 emergency hotline, the emergency form or the contact form. We clarify the facts and tell you how to preserve evidence until it’s secured.
-
02
Scoping & Individual Quote
We define goals, systems and priorities. We agree on any expansion of the scope with you in advance.
-
03
Evidence Preservation
Remotely or on-site at your premises – with hash values and a documented chain of custody.
-
04
Analysis & Reconstruction
Timeline of the attack, mapping to MITRE ATT&CK and searching for further affected systems based on the IoCs.
-
05
Supporting Containment & Recovery
We show which accounts, systems and backdoors need to be cleaned up – so that rebuilding doesn’t happen on a compromised foundation.
-
06
Report & Lessons Learned
Report and debriefing with specific measures. A penetration test can later show whether the hardening works – you can describe the scope via our Pentest Quote page.
Forensic Report
The Forensic Report: Clear for Management, Legal and IT
Our report answers the crucial questions: What happened, how could it happen, what is affected, and what needs to be done now? All findings are backed by sources and timestamps, and the evidence is secured with hash values – documented for use in court as far as possible. Whether evidence is admitted in proceedings is up to the court.
- Executive summary with the key findings
- Incident timeline and description of the attack path
- Documentation of evidence preservation with hash values and chain of custody
- Affected systems, accounts and data – as a basis for reports
- Clear separation of facts, conclusions and assumptions
- Recommendations and lessons learned
Secure Evidence Before It’s Lost
The sooner evidence is secured, the more can be uncovered. In an acute case, you can reach our 24/7 emergency hotline at +49 2932 465265-0 – or report the incident via the emergency form.
FAQ
Frequently Asked Questions About Digital Forensics
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What should we do in an emergency?
Don’t shut down or reinstall affected systems – otherwise volatile evidence in memory will be lost. Instead, disconnect them from the network, don’t log on to them with administrator accounts, write down observations with the time and refrain from investigating on your own. If the suspicion is directed at employees, initially involve only a small circle of people. Call our 24/7 emergency hotline: +49 2932 465265-0, or use the emergency form. Learn more under IT Emergency Response.
Do you work remotely or on-site?
Both. We secure evidence from cloud services, EDR systems or distributed locations remotely via secure connections; we handle disk images, individual devices or discreet investigations on-site at your premises – in Germany and internationally. We often combine both approaches.
Are the results admissible in court?
We work according to recognized forensic principles: bit-for-bit copies, proof of integrity via hash values, a carefully documented chain of custody and analysis only on copies. This way, the results are documented for use in court as far as this is possible in the individual case. Whether a piece of evidence is admitted is decided by the court.
What needs to be considered in investigations of employees?
Internal investigations touch on personal rights and data protection. Measures to uncover criminal offenses generally require a documented, specific suspicion and a careful proportionality assessment. Depending on the measure, the works council has co-determination rights, for example under § 87(1) No. 6 BetrVG (German Works Constitution Act); particular caution is required if private use of email and the internet is permitted. We coordinate the approach early with data protection, legal counsel and – where required – the works council.
Do you work with the police, authorities and insurers?
Whether you file a criminal complaint is your decision – ideally made together with your legal counsel. We support the handover to law enforcement – the first points of contact for businesses are the police’s Central Contact Points for Cybercrime (ZAC) – provide the facts for reports to the data protection supervisory authority or the joint reporting office of the BSI and the BBK, and coordinate with your cyber insurer if you wish.
Can deleted data be recovered?
Often, yes, as long as the storage areas haven’t been overwritten. With SSDs and smartphones, TRIM and encryption make recovery more difficult – so it can’t be promised. The sooner a device is secured, the better the chances.
How do digital forensics, malware analysis and a compromise assessment differ?
Digital forensics investigates a specific incident across all affected systems. Malware analysis examines any malware found in detail. A compromise assessment checks – even without a specific incident – whether attackers are present undetected in your environment.
Related pages
Discuss Your Case Confidentially
Briefly tell us what happened or what you suspect – we treat your inquiry in strict confidence. In an acute incident, call us directly: +49 2932 465265-0 – Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST), and outside these hours at the same number as our 24/7 emergency hotline – or use the emergency form.