Incident response
Preserving traces during containment and recovery.
- DURING THE INCIDENT
- 01THE PROBLEMAn incident in which the rush to restore can erase what will be needed to establish the facts.
- 02WHO IT IS FOROrganizations facing an incident, their legal teams and response teams.
- 03INTENDED OUTCOMERecovery that preserves what the investigation needs, with decisions on record.
FOR DECISION MAKERS
What changes for decision makers.
- FOR THESecurityContain without erasing“The rush to restore can destroy what will be needed to understand what happened.”What to preserve is decided before acting, and collection runs alongside containment.
- FOR THELegalFacts to decide on“Decisions about customers, regulators and contracts need facts, not assumptions.”A timeline backed by evidence, with what is known and what is still a hypothesis.
- FOR THEComplianceInvestigate without contaminating“A poorly run investigation compromises the evidence and exposes the organization.”Proportionate collection and documentation of every step, with chain of custody.
- FOR THEInsurerScope and vector“Without evidence, nobody knows how the incident started or how far it went.”Timeline, vector and scope backed by evidence.
VISIBILITY
Visible progress, protected evidence.
Depending on the case, the client follows the status, stages, dates and what depends on them through the forense.io portal. The portal does not show evidence, findings or preliminary conclusions: it is transparency about progress, without exposing the evidence.
ANONYMIZED CASES
How this works in practice.
- Attack during full operations
- SITUATION
- A retail chain with several sites suffered a denial-of-service attack followed by ransomware on a high-traffic Saturday.
- WHAT WE DID
- With crisis command coordinated by n.cirt, the forensic team preserved traces during containment and gathered indicators of compromise.
- RESULT
- Indicators and a timeline available for recovery decisions, without losing what would be needed for the investigation.
WHAT SETS US APART
Why forense.io
- 01Preserve before restoringWhat needs to be kept is decided before any action that alters the environment.
- 02Alongside containmentCollection is coordinated with n.cirt or with the client's teams and third parties, without delaying recovery more than necessary.
- 03Facts, hypotheses and limitationsThe report separates what was observed, what is a hypothesis and what could not be verified.
- 04Independent technical reviewEvery report goes through independent technical review before delivery.
- 05Chain of custodyEvery piece of evidence with a record, verified integrity and who handled it.
HOW IT WORKS
Stages of the work.
- 01Deciding what to preserve before acting
- 02Collection coordinated with containment
- 03Analysis and timeline
- 04Report of facts, hypotheses and limitations
SCOPE
What is included.
Included3✓Preservation guidance✓In-scope collection✓Report
Subject to contract2○Activation availability○Technical coordination of the response (n.cirt)
PEOPLE, TOOLS AND THIRD PARTIES
How we work with what you already have.
Work coordinated with n.cirt or with the client's teams and third parties.
- 01Your teamContains and recovers the environment; forense.io indicates what to preserve and collects alongside.containment and recovery
- 02Your legal teamDefines the purpose of the investigation and receives the facts to decide on.purpose and decision
- 03Third partiesSuppliers and n.cirt, when activated, work on the same timeline.coordination
| Activity | forense.io | Your team | Third parties |
|---|---|---|---|
| Define what to preserve | executes | approves | — |
| Containment and recovery | supports | executes | supports |
| Collection and preservation | executes | supports | supports |
| Analysis and timeline | executes | — | — |
| Decisions on the case | supports | executes | — |
HOW TO ENGAGE
Two models, as set in the contract.
- MODEL 01PreservationCollection and preservation with integrity verification and a preservation report. The material is delivered to the client.
- MODEL 02Preservation + AnalysisThe full workflow, with analysis, timeline and technical report. Moving from one option to the other is formalized by contract amendment.
FREQUENTLY ASKED QUESTIONS
What people usually ask us.
Should we shut down the machines?
It depends on the case. Before shutting down, isolating or restoring, decide what needs to be preserved; talk to a forensic specialist.
Do you handle containment?
Technical coordination of the response belongs to n.cirt or your teams. forense.io preserves and investigates, alongside containment.
Can the report be used in legal proceedings?
The method and documentation are designed for that. Defensible in court describes the method; admissibility depends on the authority.
Can we start with preservation only?
Yes. The Preservation option secures the evidence now; analysis can be contracted later, by amendment.
What happens to the material afterwards?
After delivery, forense.io keeps a copy for 30 days, with the client's authorization, and then disposes of it with a disposal record.
Want to know if Incident response fits your situation?
- conversation
- assessment
- proposal