Server and Enterprise System Forensic Examination

When an incident started and which data was accessed can often be established only from server records.

These records are retained for a limited time and rotated out. Moving quickly once an incident is suspected can decide whether the evidence is still available.

• Collection and analysis of system, application and security logs
• Review of user logon and access records
• Detection of file access, copy and delete activity
• Assessment of database access and query logs
• Search for traces of unauthorised access and privilege escalation
• Network connection records and outbound data transfers
• Building an incident timeline
• Determining the affected assets and data

Critical systems often cannot be shut down. If a system must stay online, we collect volatile data (memory, active connections) live, and where possible acquire an image for offline analysis.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Collection and verification: volatile data and logs are collected from the live system, a disk image is acquired where possible, and the hash value of every collected item is recorded.
3. Analysis: records from servers, applications and network devices are correlated to reconstruct the incident timeline.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Any organisation that suspects unauthorised access, a data leak or insider misconduct.