A cyber attack often presents organisations with far-reaching technical, organisational and legal issues within a very short space of time. In addition to containing the incident and restoring business operations, it is necessary to establish what actually happened, which systems have been affected, how far a potential attacker has penetrated the infrastructure, and whether data has been accessed, altered, deleted or transferred.
A cyberattack on a company – what actually happened?
Following a security incident, individual alerts from a security system are often insufficient to assess the true scale of an attack. A compromised user account, a suspicious network connection or malware on a single system may be just one part of a much larger incident.
The IT forensic investigation therefore takes a comprehensive approach. Depending on the available evidence, the following questions, amongst others, may be examined:
- When can the first signs of a breach be detected?
- How might the initial access to the infrastructure have taken place?
- Which systems and user accounts were affected?
- Were administrative or privileged accounts used?
- Has an attacker moved further into the infrastructure?
- Have any additional access points or persistence mechanisms been set up?
- Which files and data sets were accessed?
- Is there any technical evidence to suggest that data has been transferred or exfiltrated?
- Has any data been altered, encrypted or deleted?
- Which security mechanisms may have been circumvented or tampered with?
- Which external systems or IP addresses were involved in the communication?
- What Indicators of Compromise can be identified?
- Is it technically possible to reconstruct the original route of entry?
- What consequences of the incident can be substantiated on the basis of the available evidence?
A rigorous forensic investigation must also highlight which questions cannot be answered beyond doubt on the basis of the available data. Not every technical anomaly constitutes evidence. We therefore distinguish between established facts, technical indications, conclusions that can be drawn from them, and matters that cannot be conclusively assessed on the basis of the available data.
Why an early forensic examination is important
Digital traces are sometimes ephemeral. Log files are overwritten, cloud and security systems have limited retention periods, RAM is constantly changing, and administrative interventions can alter or destroy relevant artefacts.
Once a cyber attack has come to light, there is therefore often a conflict between three objectives: Contain the attack – safeguard business operations – preserve digital evidence.
A forensic investigation must not unduly delay the measures required to contain an ongoing attack. At the same time, relevant systems and data sources should, where possible, be backed up before any reinstallations, clean-ups or other far-reaching changes are carried out.
LanCologne can help, even at an early stage, to identify data sources relevant to the forensic investigation and to prioritise the next steps in the investigation. How Coordinate the preservation and containment of evidence, is one of the first practical questions that arises.
Initial forensic assessment of the security incident
To begin with, the facts known to date are recorded. These include, for example, the time and manner of discovery, any anomalies already identified, the systems affected, existing security alerts, known user accounts, countermeasures taken and the existing IT infrastructure.
The specific objectives of the investigation are then defined in consultation with the client. In the case of large-scale incidents, this approach enables particularly relevant systems and data sources to be prioritised.
Which systems and data sources are being examined?
Depending on the infrastructure and the incident, this may include, for example, Windows, Linux and macOS systems, Server and workstations, Active Directory and identity infrastructures, virtual systems, firewalls, VPN systems, network components, Microsoft 365, Azure, other cloud services, email systems, EDR, XDR and SIEM data, security and system logs, network and connection data, data storage devices, external storage media, RAM and backup systems may be examined or secured.
It is not the number of systems examined that is decisive, but their forensic relevance to the reconstruction of the incident.
Depending on the platform in question, we draw on the relevant specialist discipline – such as the forensic analysis of Windows systems, the investigation of Linux-Servern, macOS Forensics or the analysis mobile devices.
Digital evidence preservation and safeguarding
Where the circumstances require and where technically feasible, relevant data is backed up using forensic methods. In doing so, integrity checks can be documented and the original data can be separated from the working copies used for the investigation.
In the case of investigations relevant to evidence, a documented chain of custody may also be maintained. The aim is to document the origin and integrity of relevant investigation data in a traceable manner.
One practical question that arises during day-to-day operations is, which log data should be retained as evidence – and just like with deleted or tampered-with log files how to deal with it.
Breach analysis
The backed-up data is examined for signs of a possible breach. These may include:
- suspicious processes and programmes
- unusual user logins and newly created accounts
- Changes to permissions
- Remote access, as well as PowerShell or command-line activities
- Scheduled tasks, services and autostart mechanisms
- Network connections and malware
- tampered system files and other relevant artefacts
A key sub-question here is, which systems were actually compromised – and those who are merely suspected of being affected.
Reconstruction of the course of the attack – Incident Timeline
A key task in extensive IT forensic investigations is to reconstruct the timeline of the incident. Events from different systems and data sources are correlated with one another.
This allows a complete picture to emerge step by step: When did the attack begin? Which system was affected first? Which accounts were subsequently used? Which systems were accessed afterwards? When was data accessed, altered or encrypted?
How such a Chronology of a cyber incident We will deal separately with how it arises and where its limits lie. If several service providers are involved, this also raises the question of a shared timeline.
Initial Access and Root Cause Analysis
Insofar as the available evidence allows, an investigation is being carried out into how the initial access to the infrastructure may have occurred. Possible causes may include compromised login credentials, exposed services, security vulnerabilities, manipulated emails, remote access or other technical attack vectors.
A cause is not deemed to have been established simply because it appears technically plausible. What matters is which conclusion is supported by the artefacts that are actually present.
Further reading: Root-cause analysis of a cyber attack, Determine the route of entry using forensic methods and Conduct a technical investigation into a suspected phishing incident.
Lateral movement, scope of authorisation and persistence
In the case of more complex attacks, an attacker often does not remain on the system that was originally compromised. It is therefore possible to investigate whether other systems were targeted, whether login credentials were used, whether privileged accounts were compromised, or whether administrative tools were deployed. This often makes it possible to determine the actual scope of an incident much more accurately.
Lateral movement
The investigation is looking into whether, and if so how, other systems within the infrastructure were compromised. In more detail: Reconstructing lateral movement within the organisation.
Privileged accounts
The use of administrative accounts significantly alters the scope of an incident. For further details: Compromising of administrator accounts and stolen login details.
Persistence
Scheduled tasks, services, autostart mechanisms and additional access points may allow an attacker to gain persistent access. For further reading: Demonstrate persistence mechanisms.
Data access and potential data exfiltration
One of the most important questions following a cyber attack is often whether company data has been stolen. In this context, a clear distinction must be made between:
- The data were accessible
- Data was called up
- Data was collected or prepared for a possible transfer
- there are Technical notes to a transfer
- A transfer may technically understood will be
LanCologne documents which of these statements are supported by the available evidence. If an actual data transfer cannot be substantiated, a theoretically possible access is not used to construct a supposedly proven data leak.
Further reading: Check for signs of data exfiltration, Narrow down the scope of any data that may have been leaked and Impact on personal data.
Have a cyber incident investigated forensically
Is it an ongoing or past cyber incident? Please contact us to discuss the infrastructure affected and the issues that need to be clarified.
IT forensics following a ransomware attack
A ransomware attack does not necessarily begin with the visible encryption of data. There may be hours, days or, in some cases, even longer periods between the initial access and the encryption.
During this phase, attackers may have gathered login credentials, compromised additional systems, expanded their privileges, altered security mechanisms or examined data sets. The visible encryption may therefore merely represent the final stage of a much more extensive attack.
A forensic ransomware investigation may therefore include, amongst other things:
- Initial attack vector and affected user accounts
- privileged access and lateral movements
- Persistence mechanisms
- Tampering with security systems
- Access to Server and data sets
- Indications of data exfiltration
- Timeline leading up to encryption
The aim is to reconstruct the incident, as far as technically possible, from the first detectable event right through to the visible consequences.
Further reading: Time between initial compromise and encryption, Determine the scope of the encryption and Ransomware on Linux systems.
Microsoft 365, cloud and identity infrastructures
Microsoft 365, Azure, other cloud services, as well as Active Directory and other identity infrastructures, are among the data sources that can be secured and analysed as part of an investigation. The conclusions that can be drawn depend on what audit and log-in data is available and how long it has been retained.
Further reading: Investigating a Microsoft 365 breach, Active cloud sessions following an attack, Theft of session tokens and Resetting compromised login details and tokens.
Forensic investigation for cyber insurance
Following a cyber incident, the cause, scope and impact of a security incident may also be relevant to the settlement of a cyber insurance claim. LanCologne supports companies and – depending on the mandate – insurers or their appointed bodies in carrying out the technical investigation.
In particular, the following may be documented: the cause and chronological sequence of events, the IT systems affected, the extent of the detectable compromise, indications of unauthorised access, data access and possible data leakage, manipulation or encryption of data, technical impacts on business operations, and the investigative and security measures implemented.
The specific scope of the investigation can be agreed with the parties involved and divided into clearly defined project phases. We do not make any statements regarding insurance cover, claims for settlement or legal liability.
Further reading: IT Forensics for Insurance Companies and Check for data exfiltration before encryption.
IT forensics in the context of NIS2 and BSIG
For particularly important and important organisations, Section 32 of the BSIG provides for graduated reporting obligations in the event of significant security incidents – starting with an initial report within 24 hours of becoming aware of the incident, followed by a further report within 72 hours and a subsequent final report.
Whether a company is required to report in a specific case, and what deadlines apply in practice, is a matter for legal assessment. We do not carry out such assessments. Our role is to conduct a technical investigation.
An IT forensic analysis can provide insights into the timing and course of the incident, the systems affected, the technical implications, indicators of compromise, the possible cause and the extent of the compromise – in other words, the technical facts on which a report must be based.
Regulatory information as at August 2026. This section is not a substitute for legal advice.
Investigating large-scale cyber incidents in a structured manner
Not every cyber incident requires the same level of investigation. A single compromised workstation is very different from an incident in which multiple sites, Server, Active Directory, cloud services and hundreds of end devices could be affected.
For this reason, extensive investigations are broken down into definable project phases. Following an initial technical assessment, the objectives of the investigation, priorities, relevant systems and required resources can be determined.
This ensures that, even in the case of complex incidents, it remains clear which issues are being investigated, which systems are required for this, what findings are already available, and which further investigative steps are appropriate from a technical perspective.
Results for senior management and decision-makers
A cyber incident does not need to be understood solely from a technical perspective. Senior management, the legal department, insurers and other decision-makers often require a different explanation to that given by the IT specialists directly involved.
For this reason, in the case of extensive investigations, the detailed technical documentation may be supplemented by a management summary. This summarises the key findings in a clear and understandable manner, distinguishing between confirmed findings, technical evidence, assessments derived from these, and remaining uncertainties.
Further reading: A technically sound final report for the management and Records of management decisions.
What organisations can expect to receive following the investigation
Forensic Investigation Report
Documentation of the investigation brief, data basis, methodology, relevant findings and technical conclusions.
Incident Timeline
A chronological account of the events relevant to the security incident.
Management Summary
Summary of key findings for senior management and decision-makers.
Overview of affected systems and accounts
A diagram showing the components identified during the investigation or those likely to be affected.
Indicators of Compromise
Documentation of relevant technical indicators of compromise, where available.
Root cause analysis
Assessment of the technically plausible route of entry and the underlying cause, insofar as this is possible on the basis of the available evidence.
Assessment of potential data access and data outflows
A nuanced account of what could actually be established on the basis of the available data.
Documentation of the preservation of evidence
Where included in the scope of the contract: documentation of data backups, integrity checks and the chain of custody.
Technical installations
Relevant artefacts, tables, log extracts, screenshots and other technical evidence.
Why use LanCologne for IT forensic investigations?
Forensic investigation rather than mere troubleshooting
Our focus is not solely on restoring an affected system to working order. We examine the digital traces with the aim of reconstructing the actual sequence of events in a way that can be verified.
In-house forensic laboratory
Evidence preservation and investigations can be carried out within our own forensic facilities.
Different data sources – a complete picture
A security incident often cannot be explained by a single log file. For this reason, data from end devices, Servern, identity systems, network components, cloud services and security solutions can be correlated with one another.
Tool results are assessed critically
Forensic and security tools support the investigation but do not replace expert assessment. Where possible, relevant findings are verified using additional artefacts and data sources.
Transparent disclosure thresholds
The fact that an action is technically possible does not in itself prove that it actually took place. That is why we document not only our findings, but also their evidential value and technical limitations.
Regarding qualification: TÜV-certified IT forensic expert in Cologne.
A cyberattack has been detected – what now?
In the event of an ongoing or recently discovered cyber incident, measures to contain the incident, restore systems and preserve evidence should be coordinated.
Insofar as the specific security situation permits, potentially relevant systems and data should not be altered unnecessarily. In particular, uncoordinated new installations, clean-ups, the deletion of user accounts or log data, and far-reaching changes to the systems concerned may complicate subsequent reconstruction.
At the same time, containing an active attack is a high priority. It is therefore important to clarify the following first:
- which systems are affected
- what measures are required immediately
- which data sources need to be obtained at short notice
- which systems have the highest forensic value
- what measures have already been implemented
Further reading: Isolating systems following a cyber attack and Cleaning up or rebuilding a compromised system.
IT forensics following cyber-attacks – based in Cologne, operating nationwide
In the event of an acute cyber incident, we are available 24/7 – 365 days a year, round the clock: +49 (0)221 64306610. Normal opening hours are Monday to Friday from 08:00 to 18:00.
LanCologne is based at Horbeller Straße 31, 50858 Cologne. We have been carrying out investigations throughout Germany since 2015.
For businesses in the greater Cologne area, this location means short distances: data storage media can be handed over in person, and the systems in question can be backed up on site if necessary – for example, if transport is not feasible for operational reasons or is not advisable from a forensic perspective.
The technical basis for this is a qualification in mobile device and Windows forensics, certified by TÜV Rheinland, which is publicly available in the Certipedia certificate database under certification number 0000067863.
Frequently Asked Questions
How much does an IT forensic investigation cost following a cyber attack?
It is not possible to provide a flat-rate quote for complex cyber incidents. The effort involved depends, amongst other things, on the number and type of systems affected, the volume of data, the infrastructure, the investigation period, the available logs and the specific issues at hand. Following an initial technical assessment, the scope of the investigation can be defined and, in the case of larger incidents, broken down into individual project phases.
How soon should an investigation begin following a cyber incident?
As a general rule, as early as possible, as certain digital traces are ephemeral or may be altered or overwritten by ongoing operations. At the same time, the necessary measures to contain an ongoing attack must be taken into account.
Is it possible to determine how an attacker gained access to the organisation?
In many cases, the possible route of entry can be reconstructed on the basis of various artefacts. However, whether a definitive conclusion can be reached depends on the available data and any changes that have occurred in the meantime.
Is it possible to determine whether company data has been stolen?
That depends on the available evidence. In some cases, specific data transfers can be traced. In other cases, it can only be established that certain data was accessible or had been accessed. We make a clear distinction between these two scenarios in our assessment.
Can a ransomware attack be reconstructed?
As far as the available evidence allows, yes. Among other things, the following can be investigated: the initial attack vector, affected user accounts, privileged access, lateral movement, persistence mechanisms, access to data sets, indications of data exfiltration, and the timeline leading up to the encryption.
Can cyberattacks that took place in the past also be investigated?
Yes. Past incidents can also be investigated. However, the extent to which they can be investigated depends, amongst other things, on which systems are still in place, how long log data has been stored, and what changes have been made since the incident.
Which systems are investigated in the event of a cyber incident?
Depending on the infrastructure and the incident, the investigation may cover, amongst other things, Windows, Linux and macOS systems, Server and workstations, Active Directory and identity infrastructures, virtual systems, firewalls, VPN and network components, Microsoft 365 and other cloud services, email systems, EDR, XDR and SIEM data, log data, storage media, RAM and backup systems. It is not the number that matters, but the forensic relevance.
What data does a computer forensics expert need?
For the initial assessment, the relevant factors include the known facts, the time and nature of the discovery, any anomalies already identified, existing security alerts, the systems and accounts affected, and any countermeasures already implemented. The data to be secured subsequently is determined by the jointly defined investigation objectives.
Can Microsoft 365 be subjected to a forensic investigation?
Yes, depending on the log data available. Microsoft 365, Azure and other cloud services are among the data sources that can be secured and analysed as part of an investigation. The conclusions that can be drawn depend on what audit and log data is available in the specific tenant and how long it has been retained.
Can a compromised Active Directory be investigated?
Active Directory and other identity infrastructures are among the data sources relevant to forensic investigations. For example, log-in activities, newly created accounts, changes to permissions and the use of privileged accounts can be investigated. Whether this provides a complete picture depends on the available log data and how long it is retained.
What role does IT forensics play in cyber insurance?
Depending on the terms of the assignment, the technical investigation report can be structured in such a way that relevant technical findings are presented in a clear and comprehensible manner for insurers or their appointed bodies. The information required in a specific claim depends on the insurance policy and the terms of the assignment. We do not make any statements regarding cover.
What role does IT forensics play in NIS2-related security incidents?
We can investigate and document the technical facts underlying a security incident. The legal assessment of a specific reporting obligation should be carried out by the relevant authorities or the company’s legal advisers.
Can a forensic report be used in legal proceedings at a later date?
If this is already known at the time the order is placed, the preservation of evidence, documentation and the course of the investigation can be organised accordingly. However, it would be irresponsible to offer a blanket guarantee regarding subsequent judicial assessment; ultimately, it is the competent court that decides on the probative value.
Not just resolving a cyber incident – but understanding it
Following a security incident, technical decisions can have far-reaching consequences. LanCologne helps to secure relevant digital evidence, investigate the incident in a structured manner and document the findings in a transparent way.