Forensics Analysis After a Security Incident

How We Conduct Forensics Analysis After an Incident

Server compromised. The admin reboots it to restore operations. In that moment, all volatile data disappears: processes, network connections, traces of the attacker in memory. The result—lost evidence, inability to determine the attack vector and protect other systems. Timely forensics analysis increases the chance of identifying the root cause by 80% and cuts investigation time in half compared to ad-hoc response. In 9 out of 10 cases, we reconstruct the full attack picture within 48 hours.

In digital forensics, the rule is simple: preserve first, investigate later. Our engineers, with over 10 years of combined experience and 40+ investigations, have followed this principle from the start. We guarantee chain of custody and confidentiality. Forensics analysis is 3 times more effective than standard incident response: savings on fines can reach several million dollars, and the probability of complete attack timeline recovery is 95%.

Step-by-Step Evidence Collection Process

1. Capture volatile data: memory dump, network connections, process list.
2. Create a bit-for-bit disk image with hashing (SHA-256).
3. Collect OS logs, auditd, network device logs.
4. Isolate artifacts in a secure read-only environment.

Why the Order of Collection Matters

Digital artifacts disappear in order of volatility: from RAM to cold backups. Violating the order leads to loss of key data—the attacker may detect traces and destroy them. The table shows the typical hierarchy:

Order of Volatility (RFC 3227) is a standard we strictly follow. In 70% of incidents, critical evidence resides in RAM, which lives only seconds after power loss. Therefore, collection starts with a memory dump: a 30-second delay reduces the chance of detecting IOCs by 40%.

How Evidence Is Collected

Collection begins with a RAM dump. We use LiME—a kernel module compiled for the target system version. Simultaneously, we capture network state and processes:

# Memory dump via LiME
insmod /path/to/lime-$(uname -r).ko "path=/mnt/evidence/ram.lime format=lime"
# Volatile data
ss -tulpn > /mnt/evidence/network_connections.txt
ps auxf > /mnt/evidence/processes.txt
netstat -anp > /mnt/evidence/netstat.txt

Then we take a bit-for-bit disk image with hashing:

# Create image with hashing
sha256sum /dev/sda > /mnt/evidence/sda-hash-before.txt
dd if=/dev/sda of=/mnt/evidence/sda.img bs=4M conv=noerror,sync status=progress
sha256sum /mnt/evidence/sda.img > /mnt/evidence/sda-hash-image.txt

For cloud environments (AWS), we create a snapshot via API:

INSTANCE_ID="i-0abc123def456"
VOLUME_ID=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
  --query 'Reservations[*].Instances[*].BlockDeviceMappings[*].Ebs.VolumeId' \
  --output text)
aws ec2 create-snapshot --volume-id $VOLUME_ID \
  --description "FORENSICS: Security incident - DO NOT DELETE"

How the Chain of Custody Is Guaranteed

Each collected artifact is hashed (SHA-256) and logged in a journal. Access to the image is read-only, transmission via SSH with encryption. Example record:

EVIDENCE LOG ============
Incident: INC-XXXX-001
Date: [incident date]
Analyst: John Smith

14:32 UTC - RAM dump collected from prod-web-01
File: /evidence/ram.lime
Size: 16106127360 bytes
SHA256: a3f5b2c1d4e6f789...
Collected by: John Smith, witnessed by: Jane Doe

The chain of custody is documented in a court-admissible format: each transfer of an artifact is signed by responsible parties.

How Artifacts Are Analyzed

Analysis is performed in an isolated workstation. We build a timeline of modified files, search for deleted objects using Sleuth Kit:

# Mount image read-only
mount -o ro,noexec,nodev /mnt/evidence/sda.img /mnt/analysis
# Build filesystem timeline
find /mnt/analysis -printf '%T@ %Tc %p\n' | sort -n > /mnt/evidence/filesystem-timeline.txt
# Recover deleted files
fls -r -d /mnt/evidence/sda.img > /mnt/evidence/deleted-files.txt
mactime -b /mnt/analysis/bodyfile.txt -d > /mnt/evidence/mactime-timeline.csv

Logs and network connections reconstruct the event chain. From auditd we extract commands of a specific user, from Zeek—DNS queries and HTTP connections to suspicious domains. Each artifact's timestamp is cross-referenced with the incident timeline. In 95% of cases, we reconstruct the full attack picture within 48 hours.

What's Included

• Detailed report with a complete attacker timeline, list of compromised resources and IOCs.
• Hashed images of RAM and disks with a verifiable chain of custody.
• Recommendations for vulnerability remediation and prevention of recurrence.
• Consultation on results with potential court testimony.
• Confidentiality guarantee—all data transferred via secure channels, NDA signed.

Benefits of Timely Forensics Analysis

The report contains a detailed timeline of all attacker actions, a list of compromised hosts and accounts, and IOCs. Copies of collected artifacts with hashes are attached. Based on the analysis, we provide recommendations for closing vulnerabilities and preventing future incidents. Timely investigation reduces damage by 3 times compared to response without forensics and saves up to several million dollars in data breach fines.

Common Mistakes in Evidence Collection

Rebooting the system before collecting volatile data—loses memory and processes. Using standard utilities that may modify file metadata (e.g., tar instead of dd). Missing hashing at collection—chain of custody becomes unverifiable. Collecting logs without preserving original system timestamps. These errors are avoided by using a proven playbook and certified specialists.

Estimated Timelines

Cost is calculated individually. Contact us for a consultation—we will assess your project and timelines. Order a forensics analysis to get a detailed report and recommendations.