IT Forensics for Businesses

The Federal Office for Information Security (BSI) defines IT forensics—also known as digital forensics or computer forensics—as follows: “IT forensics is the strictly methodical analysis of data on storage media and in computer networks to investigate incidents, taking into account the possibilities for strategic preparation, particularly from the perspective of the operator of an IT system.” (Guide “IT Forensics”).

Incidents under investigation usually involve the loss of customer or confidential company data. These can harm a company through hacker attacks, internal data theft or sabotage, or unintentional disclosures.

A strictly methodical approach is of the utmost importance here, as this is the only way to produce an expert opinion that will stand up in court. “Strictly methodical” means that all evidence is verified throughout the process and that all methods used yield the same results when repeated. Thus, IT forensic experts not only analyze the devices and determine what happened; they also work with those affected to develop strategies for preventing future incidents and making IT systems more secure.

There is a distinction regarding when IT forensic analysis takes place. In post-mortem analysis, the incident is investigated retrospectively by extracting evidence from a copy of the storage medium. In live forensics, the analysis is performed while the data storage devices and computer networks are still active. This makes it possible to retrieve additional data from what is known as volatile memory.

The goal of an IT forensic investigation is to determine what happened and, if necessary, who is responsible for an incident and the resulting damage, in order to hold the perpetrator(s) accountable. The focus is usually on external attacks, but lurking threats from within the organization are often underestimated. To conduct an IT forensic analysis, there are important questions that must be answered.

The question “What happened?” addresses the reason for the investigation—for example, whether data has been encrypted or whether a hacker has gained access to the systems and is able to spy on trade secrets. The second question, “Where did it happen?” focuses on the systems—specifically, whether servers and/or workstations are or were affected, and how many. The question “When did it happen?” narrows down the timeframe of the attack. It is determined whether the attack has been ongoing for several months or is currently active. The question “Who did it?” is used to determine whether the attack originated from outside the company or took place internally, and whether the incidents can be attributed to a specific individual or group of individuals. The question “How did it happen?” is used to trace the attacker’s path and identify the steps required to carry out the incident. Additionally, the question “What can be done to prevent a recurrence?” may be relevant, particularly when conducting a security assessment.

To answer these questions, information is extracted from cloud systems, computers, servers, and other electronic devices and systems, and an admissible expert report is then prepared. In this report, the findings are presented and contextualized.

Thanks to our many years of experience in IT forensics, we are usually able to accurately assess the scope of the IT forensic investigation during the initial consultation. Many factors play an important role in IT forensic analyses. To make an analysis as efficient as possible, it is important to narrow down the timeframe of the incident as precisely as possible. For example, has data been stolen over the past three weeks, or is only one day affected? We then examine evidence only from this specific timeframe and not from the entire operational history of the system. The scope of the investigation is therefore tailored to your specific needs.

Another key factor is the size and number of data storage media to be examined. At the start of each assignment, IT forensic master copies and working copies are created. This involves creating IT forensic copies of the data storage devices. In this process, the contents are copied 1:1 to a new data storage device. The duration therefore depends on the size of the data storage devices to be copied.

The process of extracting information from the data storage media onto the analysis system also varies with each investigation. We then manually verify the results of an analysis to ensure reproducibility. Upon completion of the IT forensic analysis, an admissible IT expert report is prepared, which contains the processed information and is tailored to the relevant audience. This report details the steps taken and the results of the analysis.