IT forensics and incident response

When you need IT forensics

• A server, laptop or cloud account behaves oddly, and nobody knows why.
• Data has been encrypted (ransomware), or someone is demanding a ransom.
• Customer data or internal documents have turned up where they do not belong.
• An account has been taken over, for example through phishing or stolen credentials.
• An employee is suspected of taking data or misusing their access.
• Your insurer, management or an authority needs a reliable account of what happened.

Often it starts as a suspicion. A check is still worth it: either it shows that nothing happened, or it finds the incident before it grows.

First steps when you suspect an incident

What happens in the first hours decides whether an incident can be cleared up later.

1. Do not switch it off. A running system holds traces in memory that are lost on shutdown. Disconnect affected systems from the network instead.
2. Do not clean up. No deleting files, no reinstalling, no antivirus with automatic cleanup. That destroys exactly the traces that are needed.
3. Secure the logs. Firewall, VPN, mail and cloud logs often have short retention periods. Export them or extend the retention.
4. Write down what you know. Who noticed what and when, and what has been done since? With times.
5. Check access. Change passwords of affected accounts only once you know the attacker is not watching, for example through a compromised mailbox.
6. Keep reporting duties in mind. Under Art. 33 GDPR, a breach involving personal data usually has to be reported to the supervisory authority within 72 hours.

Approach

First response and containment

Together with your team, I narrow down which systems are affected and stop further spread without destroying evidence.

Evidence preservation

Disks, memory, logs and cloud data are secured and documented with checksums. A complete chain of custody records who secured what and when, so the findings hold up with third parties.

Analysis

I analyse logs, file systems, accounts and configurations, in classic infrastructure as well as in Microsoft 365, Google Workspace, AWS, Azure or GCP. The goal is to answer three questions: How did the attacker get in? What did they reach? Are they still there?

Timeline

The traces become a timeline of the attack, from first access to discovery. It shows which data was at risk and when, and it is the basis for notifications and decisions.

Report and hardening

The result is a report in two parts: a summary for management, insurers and authorities, and a technical part for your team. The weaknesses found feed straight into concrete measures, so the same path does not work twice. If an account was taken over through phishing, that usually includes phishing-resistant login with YubiKeys or passkeys, which I can roll out with your team.

What you get

• A traceable reconstruction of the incident instead of guesswork
• Secured and documented evidence
• A solid basis for notifications under GDPR and, where it applies, NIS2
• Answers for your insurer, customers and management
• Prioritised measures that fix the cause, not just the symptom

Remote or on site

Much of the analysis can be done remotely, especially for cloud environments. I work remotely across the DACH region and on site within about 150 km of Oldenburg. I exchange findings and credentials only encrypted, with PGP if you prefer.

Related services: IT security & IAM for the hardening afterwards, AI security when a language model or agent is involved.