Digital forensics
Collecting and examining digital evidence on devices, servers and logs after a security incident, in a way that keeps its value as evidence.
- 01
Why it matters
A forensic investigation shows how the attacker got in, what they accessed and whether they are still inside. This is needed both to close the hole and for legal notification and insurance processes. Preserving evidence unchanged and recording who touched it and when determine how reliable the findings are.
- 02
Example
After a data leak, the investigation team takes copies of the server's memory and disk, arranges the logs into a timeline and establishes that the attacker came in three months earlier through an old plugin. The notification is made with the exact list of affected records.
- 03
Common mistake
Shutting down and rebuilding the system, or deleting logs, right after the incident. Once the evidence is gone, nobody can ever know what happened or how much data was affected.
- 04
Related terms
Related services and guides
Let's talk about your project.
Tell us what you need; we will define the scope together.