IT Forensics · Business

What a company can expect from a forensic investigation following a serious cyber attack

Once an attack has been contained, senior management, data protection officers, insurers and legal advisers all ask the same questions: How did the attacker gain access? How long had they been on the network? Which accounts, systems and data were affected? Was any data stolen? A forensic investigation answers these questions on the basis of the secured primary data – and identifies where the available data does not allow for a definitive answer.

Enquire without obligation

Why this question is important for a business

Following a cyberattack, technical, economic, data protection and regulatory decisions may all depend on the same set of facts. A robust reconstruction must therefore clearly distinguish between proven activity, technical feasibility and mere conjecture.

Technical background

The answers are scattered across various sources: Windows event logs, EDR telemetry, firewall and VPN logs, Microsoft 365 and Entra ID logs, Active Directory changes and traces on individual endpoints. Many sources have short retention periods; if they are reset after the incident, they are lost.

Relevant evidence and data sources

• Windows Event Logs (including logins 4624/4625, service installations 7045, PowerShell logs)
• EDR/antivirus telemetry and quarantine
• Firewall, VPN and proxy logs
• Microsoft 365 Unified Audit Log and Entra ID sign-in logs
• Active Directory changes, new accounts and group memberships
• Artifacts on Patient Zero systems (Prefetch, Amcache, Shimcache, SRUM)

Borders

• Missing or overwritten logs limit the ability to reconstruct events.
• It is not always possible to prove or rule out with certainty whether data has been leaked.
• Legal assessments (reporting obligations, liability) are carried out by data protection officers and legal advisers.

Possible results

• Attack vector and timeline confirmed
• List of affected accounts, systems and data sets
• Exfiltration confirmed, not detectable or cannot be ruled out
• Recommendations for closing off the attack vectors

Why LanCologne?

Following a cyber attack, a company’s immediate priority is security and operational continuity. However, simply knowing that ‚an attack has taken place‘ is not enough to inform subsequent decisions.

Here’s how we do it

• Coordination of the key questions with senior management, the insurance company and legal advisers.
• Prioritising the safeguarding of volatile and short-lived sources.
• Reconstruction of initial access, privilege escalation, lateral movement and potential exfiltration.
• Final report with an executive summary and a technical appendix.

Incident response and forensics have different but complementary objectives

The primary aim of containing an ongoing attack is to protect the organisation. Forensic reconstruction then clarifies – either subsequently or in parallel – what actually happened. Necessary security measures are therefore not withheld simply to preserve an ideal state of evidence; unavoidable changes are documented as far as possible.

Why LanCologne following a cyberattack?

LanCologne does not base its investigation on a hypothetical sequence of events. What matters is what technical conclusions can actually be drawn from the primary data obtained. Findings that are incriminating, exonerating or inconclusive are documented in a transparent manner so that the management and legal advisers can make decisions based on verifiable facts.

Article 32 of the GDPR requires data controllers and data processors to ensure a level of protection appropriate to the risk. Among other things, it refers to confidentiality, integrity, availability and resilience, as well as the ability to restore availability and access promptly following a technical or physical incident.

If a cyber incident has resulted in a personal data breach, Article 33 of the GDPR may apply. Such a breach must, in principle, be reported to the competent supervisory authority without undue delay and, where possible, within 72 hours of it coming to light. An exception applies if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 33(5) also requires the breach, its effects and the remedial measures taken to be documented. Where the risk is likely to be high, Article 34 of the GDPR may also require that data subjects be notified. The legal assessment of the obligation to report rests with the controller, in consultation with their data protection and legal advisers; IT forensics provides the technical facts for this purpose.

Since 6 December 2025, the revised BSI Act, which implements the NIS 2 requirements, has applied to certain private companies. Whether a company is classified as a particularly important or important organisation must be assessed on a case-by-case basis in accordance with the current BSI Act, taking into account the sectors, types of organisation and size criteria. For covered organisations, the BSIG sets out, amongst other things, obligations regarding cybersecurity risk management and security incidents; Section 38 of the BSIG assigns obligations to the management of particularly important and important organisations to implement and monitor risk management measures.

Statutory reporting and documentation obligations may be time-sensitive. However, LanCologne does not make any definitive legal determinations regarding reporting obligations, responsibility or liability. We provide the technically verifiable factual basis on which management, data protection officers and legal advisers can make decisions.

Frequently Asked Questions

🔗 Related topics