Incident investigation and forensics
Need to know what happened?
An incident investigation establishes how attackers got in, what they accessed or took, whether they are still present and what to fix. If you need those facts after ransomware, Business Email Compromise, an account takeover, a data exposure or insider activity, call our 24/7 incident line at 1-650-300-7557. ACS Cyber investigates in-house, preserves evidence with documented chain of custody and writes findings your leadership, insurer and counsel can use.
01
Preserve, do not clean up
Do not wipe, reimage or restore affected systems yet. Disconnect them from the network instead, and leave them powered on unless we advise otherwise.
02
Keep the records
Keep logs, audit trails, suspicious emails and files, and any messages from the attacker. Check that retention settings will not delete the records you need.
03
Write down what you know
Note what was noticed, when and by whom, and every change made since. That record becomes part of the timeline.
04
Involve counsel and your insurer
Many organizations have breach counsel engage the investigation. Check your policy’s notice requirements before significant costs are incurred.
05
Call before you rebuild
Call our 24/7 incident line. We agree on what to collect first, and how, with someone authorized to approve it.
- Ransomware or extortion
- Business Email Compromise
- Account takeover
- Data exposure
- Insider activity
- Malware or unauthorized access
Not a client yet? You can still call. Our incident line is answered 24/7 for organizations nationwide, whether the incident is still active or already contained.
In plain terms
What an incident investigation is, and who it is for
An incident investigation is the evidence-based work of establishing what happened in a security incident: how the attacker got in, what they did and reached, and whether they still have access. Digital forensics is the discipline behind it: collecting and analyzing records in a way that keeps them intact, so the findings can be relied on.
ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. Our forensic investigation is performed in-house, by the same organization that runs our SOC, for organizations nationwide. Learn more about our incident response and DFIR services.
It is for organizations that have had, or suspect, a ransomware attack, Business Email Compromise, an account takeover, a data exposure or insider activity, and now need facts for leadership, an insurer, breach counsel, regulators or customers.
Who relies on the findings
- Leadership, to make decisions and plan recovery
- Your cyber insurer, to support the claim
- Breach counsel, to advise on notification
- Regulators or customers, when counsel advises that notice is needed
- Your IT team or provider, to fix the root cause
What it answers
The questions an incident investigation answers
Every investigation is scoped to the incident, but most work toward the same answers. Where records were never kept or have been deleted, the findings say so plainly.
| Question | Where the answer usually comes from | Why it matters |
|---|---|---|
| How did they get in? | Sign-in records, email, endpoint activity, and remote-access and firewall logs | The way in must be closed before systems are trusted again |
| What did they access or take? | File, mailbox and database activity, cloud audit logs and network records | Your counsel needs this to advise on notification |
| Are they still present? | New accounts, remote-access tools, scheduled tasks, inbox rules and app consents | Recovery is not safe while the attacker can come back |
| When did it start, and what happened since? | Timestamps from every source, correlated into one timeline | The timeline supports claims, notification decisions and reporting |
| What should we fix first? | The root cause and the weaknesses the attacker used | Remediation starts where it reduces the most risk |
Evidence handling
Evidence preserved, with documented chain of custody
Evidence is easy to lose. Wiping or reimaging a device, restoring from backup, deleting a mailbox or letting logs expire can erase the records that show what happened. Our first priority is to preserve what exists before anything else changes.
Chain of custody is the documented record of who collected each item of evidence, when and how, and who has handled it since. Our in-house forensic team keeps that record, so the findings can support insurance claims, legal review and, if you choose to report, law enforcement.
- Affected systems, memory and logs collected before they change, where possible
- Every item recorded: what it is, where it came from, who collected it and when
- Secure evidence handling, arranged once we are engaged
- Findings that trace back to the evidence they rest on
Please do not email evidence
Do not send passwords, logs, health information, financial records or evidence files to anyone by email or chat, including us. Once we are engaged, we arrange secure evidence handling.
Atlantic Computer Systems, our parent company, sets out its data-protection commitments on its trust page.
Sources we examine
Where the evidence comes from
We examine the sources the incident touched. Log retention varies by platform and subscription, so early collection matters.
Endpoints and servers
Workstations, laptops and servers: running processes, file activity, memory where it can still be captured, and anything an attacker installed to keep access.
Microsoft 365 and Google Workspace
Audit logs, mailbox activity, message traces, inbox rules, forwarding, file sharing, admin changes and app consents.
Identity and sign-ins
Sign-in records, MFA registrations and changes to privileged accounts, showing which accounts were used, from where and when.
Firewall and network records
Firewall, VPN and remote-access logs, and network records that show connections coming in and data going out.
Cloud consoles such as Azure and AWS
Activity logs, access keys, storage permissions and resource changes in your cloud accounts.
Backups
Whether backups were reached, changed or deleted, and which copies predate the attacker’s access.
Deliverables
What you receive
Findings are written for the people who need them. Leadership gets a plain-language summary for decisions, your IT team or provider gets the technical detail to fix the root cause, and your counsel and insurer get a documented account they can rely on.
You also get updates as facts are established, not only at the end, because early findings can change containment and recovery decisions. When the investigation is done, see recovery and protection after an attack for what comes next.
- Executive summary: what happened, what it affected and what we recommend, in plain language
- Technical findings: how access was gained, what the attacker did and what they left behind
- Timeline: from first access to containment, with the evidence behind each event
- Affected-data analysis: which systems, mailboxes and types of data were involved, organized so your counsel can use it
- Remediation recommendations: prioritized fixes, starting with the way in
Counsel and insurers
Working with your breach counsel and insurer
Many organizations have breach counsel engage the forensic investigation. When your counsel engages us, we work at their direction: counsel decides how the investigation is scoped, documented and reported, and we work within that structure.
If your cyber insurer assigns a response firm, we work alongside it where your policy permits, for example on containment, recovery and the IT work that follows. We coordinate with your insurer when you authorize it. Notify your carrier early: many policies set notice requirements, and some require approved vendors or the carrier’s consent before costs are incurred.
Whether an incident is a reportable breach, and whom to notify, are decisions for your organization on your counsel’s advice. Our part is the facts those decisions depend on.
What we do not do
- Give legal advice or reach legal conclusions
- Decide whether an incident is a reportable breach
- Make notification decisions for you
- Claim answers the records cannot support
FAQ
Incident investigation questions
A forensic investigation is the evidence-based work of establishing how attackers got in, what they accessed or took, whether they still have access and what to fix, with the evidence preserved and documented. ACS Cyber performs forensic investigation in-house, with documented chain of custody. Our 24/7 incident line is 1-650-300-7557.
From the records your systems keep: sign-in logs, email and audit logs, endpoint activity, firewall and remote-access logs, and cloud activity logs. Our in-house investigators correlate those sources into one timeline to find the first point of access and the route the attacker took from there. The sooner records are preserved, the more of them are still available.
No. Wiping, reimaging or restoring a device can destroy the evidence that shows what happened. Disconnect affected devices from the network instead, leave them powered on unless advised otherwise, and call an incident response team before you rebuild anything.
Yes. You do not need to be a client to call our 24/7 incident line, and we work alongside internal IT teams, IT providers and insurer-assigned response firms where your policy permits. We start from what has already been found and preserved. The earlier we are involved, the more evidence is likely to remain.
That is a question for your legal counsel. Many organizations have breach counsel engage the investigation, particularly when sensitive data may be involved. When counsel engages us, we work at their direction on how findings are documented and reported. We do not provide legal advice.
No. The investigation establishes what happened in this incident, while the HIPAA Security Rule risk analysis is an ongoing requirement of its own. Investigation findings can inform your next risk analysis. Atlantic Computer Systems, our parent company, provides HIPAA risk assessments.
Containment comes first. Call our 24/7 incident line at 1-650-300-7557, or see active incident support. We help you cut off the attacker’s access in a way that preserves evidence, and the investigation continues from there.
24/7 incident line
Need the facts about an incident?
Call 1-650-300-7557 and speak with our incident team. If the incident is contained and you want to plan an investigation, book a free 30-minute consultation. For other incidents, see how we help after any compromise.