Cyber investigation: establishing what actually happened

When a digital investigation makes sense

Most cases start with a doubt: an account signing in from an unfamiliar country, a transfer someone says they never approved, an employee who left with files, a forwarding rule found in a mailbox. The investigation turns that doubt into an established timeline — or finds that no trace supports it.

• Compromise of a computer, a server or an online account
• Unauthorised access to a mailbox, a cloud workspace or Microsoft 365
• Digital fraud: fake supplier, CEO fraud, diverted payment
• An employee leaving and a suspicion that data was copied
• A ransomware incident, to establish what may have been copied before encryption

What we examine

Computers and servers

File systems, event logs, execution history, USB devices connected, browsers, scheduled tasks and accounts created: the traces that allow an action to be dated and traced back.

Cloud and Microsoft 365

Audit and sign-in logs, mailbox rules, sharing, authorised applications, registered devices. Their retention is limited and depends on the subscription: often the first thing to freeze.

Messaging and email

Full headers, look-alike domains, hijacked reply addresses, SPF, DKIM and DMARC checks, to tell simple address spoofing apart from a genuine mailbox intrusion.

Erased traces

Deleted files, emptied recycle bins, purged logs or backdated items, while the media still allow them to be recovered. This is never guaranteed, and the report says so.

Collection and preservation

Media are copied and each copy receives a SHA-256 cryptographic hash. Analysis then works on those copies: the original stays intact, and anyone can recompute the hash to check that nothing has changed. Every operation is recorded — who, when, how — in a chain of custody.

For live systems, the aim is to preserve without bringing the business to a halt: isolate from the network rather than power down, freeze logs before they expire, extend their retention. Our guide to preserving digital evidence sets out these precautions.

The report

The report separates findings from their interpretation. It describes the method, the media examined, the hashes, the reconstructed timeline and the limits of the analysis: what could be established, and what could not. It is written to be read by management, an insurer, a lawyer or, where relevant, a court. Assessing the evidential weight of the material is a matter for the court.