home  /  incident response & forensics
department of incident response & forensics

The evidence is disappearing while the decision is being made.

Logs roll over in days. Memory is gone at reboot. Remediation destroys the record it is fixing — and all three happen before most matters have counsel.

begin here

What happened, and when did you learn of it?

Start a conversation with the Incident Concierge, already scoped to incident response & forensics. Select a subject area to prompt it, or describe the incident directly.

Incident Conciergeincident response & forensics · orientation, not a security opinion
Tell me when the incident was discovered and what has already been done — particularly whether anything has been rebooted, reimaged or restored. That decides what evidence is still recoverable, so it is the first thing worth establishing.

Incident response creates two problems at once that pull in opposite directions. The security imperative is to contain and remediate immediately: isolate the host, rotate the credentials, reimage the machine, restore from backup. The evidentiary imperative is that every one of those actions destroys the record of what happened. Volatile memory — where the running malware, the live network connections and the decrypted keys are — does not survive a reboot. Log retention is frequently thirty days and often less, so by the time an intrusion is discovered the earliest evidence may already have aged out. A reimaged host is forensically gone. None of this argues against responding quickly; it argues for capturing before you cure, and for someone raising that in the first hours rather than the second week.

specialization areas

Areas in this part of the practice.

What to preserve and when, how response adequacy is judged, and how far attribution honestly goes.

Evidence preservation

The most time-critical page on this site. What disappears, how fast, and what to do in the first hours.

investigate

Response adequacy

Judged on what was known at each moment — not on the timeline as it reads afterward.

investigate

Attribution & scope

What was actually reached matters more than who did it — and is far harder to establish than assumed.

investigate
methodology

How this department investigates.

How the Institute approaches response — what the analysis needs, never an assessment of a live incident.

Preservation triageWhat is disappearing fastest, and what has to be captured before remediation continues.
Volatile evidenceMemory, live connections and running processes. Gone at reboot and irreplaceable.
Log scope and retentionWhich logs exist, how far back, and when they roll — established immediately, not eventually.
Timeline reconstructionInitial access, dwell time, lateral movement, exfiltration. The spine of every later argument.
Response adequacyWhether detection, containment and notification met the standard, judged on what was known then.
Attribution limitsWhat the evidence supports about who did it, and where honest analysis stops.
news & insights

Writing from the Institute on response.

Why the forensic record has a shorter life than anyone expects, what an adequacy analysis actually examines, and how far attribution can honestly be taken.

Is the forensic incident response report privileged?

Not by default, and not because a law firm signed the engagement letter. Four federal decisions ordered production, and the reports that stayed protected differed in ways that were set up before the investigation began.

read

What does dwell time prove about an incident?

It bounds what an intruder could have reached and it is evidence about detection. It is not by itself evidence of what was taken, and the number is usually a floor set by how long the logs survived.

read

What evidence disappears first after a breach, and how fast?

Volatile memory is gone at the next reboot. Log retention is commonly thirty days and sometimes seven. Both clocks are usually running before anyone has called a lawyer.

read

Does reimaging a compromised machine destroy the forensic evidence?

It ends the record on that host — and it is also correct security practice. The tension is real, it is resolved by imaging first, and it is usually created by people doing their jobs properly.

read

How is the adequacy of an incident response judged after the fact?

Against what was reasonably knowable at each decision point — not against the timeline as it reads once the full picture is known. The recurring findings are delay in escalation and containment that outran the investigation.

read
all incident response & forensics insights
common questions

Response and forensics — the questions counsel ask.

What has to be preserved, and how fast?

Faster than almost anyone moves. Volatile memory first, because it disappears the moment a machine is rebooted and it holds the running malware, live connections and sometimes decrypted credentials. Then a forensic image of affected systems before any reimaging. Then logs — and this is the one that catches organizations out, because retention is commonly thirty days and sometimes seven, so the earliest and most important evidence of initial access may age out while the response is still underway. A written litigation hold covering security telemetry, and an immediate instruction to suspend log rotation, are the two cheapest things anyone can do on day one.

Does responding properly destroy our evidence?

It can, and the tension is real rather than theoretical. Isolating and reimaging a compromised host is correct security practice and it ends the forensic record on that host. Restoring from backup overwrites the compromised state. Rotating credentials is essential and removes the ability to observe how they were being used. The resolution is sequencing rather than choosing: capture first, then cure. A forensic image takes a fraction of the time people assume, and an organization that images before remediating retains both its security response and its evidence.

How is response adequacy actually judged?

Against what the organization knew at each point, not against the completed timeline. The analysis asks whether detection was reasonable given the monitoring in place, whether containment followed within a reasonable period of detection, whether the scope investigation was competent, and whether notification obligations were met on their own clocks. The most common criticism is not slowness but scope: an organization that contained what it found without establishing what else the attacker reached frequently discovers more later, and that second discovery is far more damaging than the first.

Can you tell us who attacked us?

Rarely with the confidence people want, and overclaiming here is a serious credibility risk. Forensic evidence usually supports statements about tooling, technique and infrastructure — that the activity is consistent with a known pattern — and rather less often supports naming a specific actor. Infrastructure is rented and shared, tools leak and are reused, and false flags exist. For most civil matters attribution also matters less than it feels like it should: what drives the case is what was accessed, when, and whether the safeguards were reasonable, none of which depends on knowing the attacker's identity.

Preserve before you remediate.

Describe what has happened and what has been done. The Institute will help you see what is at risk.

incident conciergeorientation · not a security opinion
Tell me when the incident was discovered and what has already been done — particularly whether anything has been rebooted, reimaged or restored. That decides what evidence is still recoverable, so it is the first thing worth establishing.