Generally all common systems such as Windows, Linux, MacOS clients and servers, but also other devices such as smartphones. In general, however, other data can be included in an analysis, such as network data from a firewall or a proxy.

The result of a forensic analysis is the answer to certain questions that we put to the system in consultation with you. We determine the attacker’s activities on the system and display them. Since the forensic analysis of a system can take a long time, it is all the more important to formulate these forensic questions in concrete and specific terms.

Generally none. However, technical settings can be activated that increase the information content of the systems and can therefore be used for forensic analyses. This is referred to as “forensic readiness”. Increasing this “forensic readiness” can significantly improve the efficiency of forensic analysis and provide more insights into the attackers’ approach.

Do not switch off the device beforehand! This can destroy relevant traces, such as the working memory. The device must be isolated on the mains side until all necessary system images have been created.

There are two options here, either the complete physical system is transmitted or only the digital images. If the complete device is to be transferred, this will be done by courier. If images that have already been created are to be transmitted, this is done via a secure file storage facility provided by SECUINFRA.

There are different types of images that are created by the affected systems and then used for the analysis. If the system is still switched on, an image of the working memory (RAM) can be created. This image contains a lot of relevant information about processes, network connections, etc. In most cases, an image of the hard disk is created. There are different types of images here, such as the full disk image and the triage image. The full disk image is a 1:1 bit copy of the hard disk and contains all the information that can be found on the original hard disk. As the creation of this image can be very time-consuming, so-called triage images are often used in time-critical situations. Only previously defined files that are of forensic interest are copied. This has the advantage that the analysis is significantly faster, but the disadvantage that not all the required information may be available.

Our procedure for collecting and storing evidence is based on the ISO 27037 standard. The evidence is stored securely in a safe and the laboratories are only accessible to authorized personnel.