Need to collect evidence from the attack debris (forensics). Who does it? How is it done?

hire a dgital forensics expert also file a complaint with the police... dont touch the disk get a pro to do imaging. find the timeline and malware write a report... like document the chain of custody — evidence needs to be admissible in court...

Digital forensics workflow: 1) Acquisition (dd tool: dd if=/dev/sda of=image.img bs=1M, verify MD5 hash), 2) Analysis (FTK Imager, EnCase, Volatility memory analysis), 3) Timeline (file timestamps: creation, modification, access — MAC times), 4) Artifact recovery (Windows Registry hives, browser cache, email databases), 5) Malware analysis (static + dynamic: sandbox execution, memory dump analysis), 6) Reporting (SANS format: methodology, findings, recommendations). Chain of custody form: device identifier, date/time of handover, signature of the person handling it, storage conditions, access log (who accessed it, when). Admissibility in court (Turkish Code of Criminal Procedure): expert credentials, methodology verification, reproducibility (can another expert reach the same result).

dont touch the computer, hire a forensic expert. do disk imaging, document the hash. document the chain of custody — who had it when. btw include timeline and malware analysis in the report but admissibility of evidence in court depends on the accuracy of the methodology...

Digital forensics stages: Preservation (immediate evidence capture, no system changes), Acquisition (bit-for-bit copy, cryptographic hash verification), Examination (data parsing, artifact extraction), Analysis (timeline reconstruction, causality linking), Reporting (structured documentation, validation of findings). Quality assurance: independent verification (second analyst review), tool validation (only approved forensic software), expert qualification (certifications: GCFE, CFE, ECCE). Legal admissibility: Daubert standard (US courts) or equivalent (EU/TR courts require the methodology to be peer-reviewed, error rates known, and generally accepted in the field).

My questions are cleared up, thanks. When we decide without measuring, we always end up in the same place.

I'm also curious if anyone does it differently.

We experienced almost the exact same thing last year. Your time to detect an issue directly determines its cost.

Just leaving this note, it might be useful.

It's rare to find an explanation this clear. Hasty decisions become decisions you have to fix six months later.

thnks a lot I'll try it today but i mean when making decisions, write down the worst-case scenario too, not just the best.

taking measures without an inventory laves doors you havent seen open.

it's rare to find an explanation this clear.

I can't fully agree with this. When making decisions, write down the worst-case scenario too, not just the best.

Taking measures without an inventory leaves doors you haven't seen open. If you have questions, write them; I'll answer as best I can.

I agree with this. If it's your first time, start small; scaling comes later.

If I were you, I'd go this route.

Generally correct, but one part is missing. The biggest time-waster for us was not knowing who had the final say.

Hope this helps.

The cheap-looking path usually ends up costing more later. Solutions that work at a small scale collapse when you grow; I learned this late.

Processes without records never improve, because you don't know what to fix. Of course, it varies if your situation is different.

i agree, and I'd like to emphasize that. when you try to change everything at once nothing settles.

i'm also curious if anyoen does it differently.

The most overlooked point about digital forensics investigation is this: Don't rely on a single measure; go layer by layer.

When making a decision, first look at what data you have on hand. anyway im also curious if anyone does it differently.

Don't miss this: If permission and scope aren't in writing, don't start that test.

An untested backup is not a backup.

Good call starting this thread. If you get three different answers on a topic, the question was asked wrong.

That's all, sorry if I went on too long.

Yes, that's exactly how it is with digital forensics investigation. Most time waste accumulates in tasks waiting for approval.

Having backups accessible on the same network and with the same identity makes them part of the target. That's all, sorry if I went on too long.