Preserving evidence after a breach: the first decisions
To preserve evidence after a breach, isolate affected machines from the network instead of powering them off, capture memory before any shutdown, export logs before retention deletes them, and do not reimage anything until a copy exists. Write every action down with a time. Bring counsel in early, because privilege is easier to set up at the start than to claim later.
The first decisions, in order
- Do not reimage first. A clean rebuild feels like progress and erases the only record of how the intruder got in.
- Isolate, do not power off. Pull the network cable, move the machine to a quarantine VLAN or use the EDR console’s isolation feature. Leave it running.
- Capture memory where you can. A memory image taken before shutdown holds processes, connections and injected code that the disk never sees.
- Export logs now. Identity provider sign-ins, email and cloud activity logs, firewall and VPN logs, EDR alerts. Retention will not wait for the investigation to start.
- Start the timeline. What was seen, when, by whom, and every action taken since. A named owner keeps it in one place.
- Call counsel and your insurer. Before outside responders are engaged, not after.
Why memory comes before disk
Evidence disappears at different speeds. RFC 3227, the long-standing guideline on evidence collection, calls this the order of volatility: collect what vanishes fastest first. Memory and live network connections are lost at power-off. Disk contents usually survive until something overwrites them.
Memory capture needs a tool on the machine and someone who has done it before. If neither is available, isolation still preserves the disk and the logs, which is most of the case.
Which logs disappear first
Default retention on many cloud and SaaS logs is shorter than people expect, and firewalls often keep a rolling buffer rather than a history. The sign-in record of the attacker’s first login may be the first thing to go. Export to storage the compromised accounts cannot reach, then see whether retention can be extended.
What chain of custody means for digital evidence
Chain of custody is a record of who collected each item, when, how, and where it has been since. For digital evidence that means a hash taken at collection, analysis on a copy, and a log entry each time the item changes hands. A spreadsheet kept from the first hour is enough. One reconstructed a month later rarely is.
When to involve counsel and police
We are not lawyers; we work alongside your counsel. Many organizations have counsel engage the forensic work, and that is simplest to arrange before any work starts. Your cyber policy may also name the responders it will pay for. If police become involved, they will ask for the same evidence and timeline; see working with police after a cyber incident.
The wider first-day sequence is in the first 24 hours of an incident, and how we support the response itself is on incident response and digital forensics. Investigation and forensic work is delivered with appropriately licensed partners where the law requires it.
Questions we are asked
Should we reimage the infected machines?
Not yet. Reimaging destroys the disk evidence that shows how the intruder got in, so take a forensic image or at least preserve the drive first, then rebuild.
Should we power off or disconnect a compromised machine?
Isolate from the network and leave the machine running. Powering off erases memory, which holds running processes, network connections and sometimes encryption keys that exist nowhere else.
How long do we have before logs are gone?
It depends on the source, and some go within hours or days. Firewall buffers, EDR telemetry and cloud sign-in logs roll over on their own schedules, so export them on day one rather than stopping to check each retention setting.
Who should direct the forensic work?
Counsel, where possible. We are not lawyers; we work alongside your counsel, and whether privilege attaches to the forensic work is their call, made most easily before that work begins.
How the work is bounded
The scope is agreed in writing before work starts, and the engagement is quoted in writing with it.
Investigation and forensic work is delivered with appropriately licensed partners where the law requires it.
SecHB does not issue certifications, attestations or audit opinions: those come from accredited certification bodies, CPA firms and QSAs. The work here is what an organization does to be ready for them.
Nothing here is legal advice. Where a question turns on the law, the work is done alongside the client’s counsel, not instead of them.
Getting the first decisions right
If something has happened, tell us what was seen and what has been done so far. Related pieces are indexed at writing.