Digital forensics: What happens after a data breach?

It's now almost inevitable that sooner or later, almost every business will be the target of a cyber attack, and larger companies with more resources and data make even more tempting targets for criminals.

While there are many steps organisations should be taking to prevent incidents, from implementing tough perimeter security to constant network monitoring, no system is foolproof. Therefore, businesses also need to have a plan for what to do if they are successfully breached.

Once initial containment and recovery steps have been taken, key questions will include 'what happened?' and 'how do we stop it happening again?' And to effectively answer these queries, firms need digital forensics specialists. 

Digital forensics v incident response

Digital forensics is a fast-growing role for IT professionals. They may work in intelligence or law enforcement, but they are also increasingly employed directly by large enterprises, or brought in as consultants, to help recover from a cyber attack.

In businesses, these professionals usually work closely with the incident response team, but the two roles shouldn't be confused. While incident response professionals are often seen as the first line of defence, firefighting any breaches as soon as they are discovered, the job of digital forensics experts is usually to conduct a more in-depth investigation.

This will set out exactly how the breach occurred, from where the initial infiltration happened, to what vulnerabilities were exploited, how hackers moved within the network and how any data was exfiltrated.

On the back of this, digital forensics professionals will produce a comprehensive report that cyber security teams can use to strengthen their defences. In addition to this, the findings of these efforts will often be shared directly with law enforcement for use in any criminal investigations and prosecutions.

5 stages of a digital forensics investigation

If you are going to focus on digital forensics, there are a few key stages of the process that you'll be expected to be familiar with. These can broadly be broken down into five key stages that every investigation should cover.

1. Identification

Stage one must be to determine whether or not a breach has actually taken place - which may not always be as obvious as it seems. Then, once it is confirmed, it requires professionals to identify affected systems, spell out the terms of the investigation and determine what resources are required.

2. Preservation

The next task must be to isolate and secure all systems, devices and data affected by the incident. This isn't just to ensure that any breach is contained. It also prevents any tampering with systems - intentional or otherwise - that could interfere with the results of the investigation.

3. Analysis

The bulk of the work will involve studying the affected systems to uncover evidence and reconstruct any fragments of data that criminals may have left behind. Key questions to ask at this stage include who has created the data, who has accessed and edited it, when any activities occurred and what tools or code were used. This can then be used to draw conclusions and build a timeline of what happened.

4. Documentation 

Collecting and documenting all relevant evidence is an essential part of the digital forensics life cycle. This may include and digital evidence recovered from affected systems or devices, as well as any physical evidence or mapping of the path of an intrusion, and is used to recreate a full picture of the crime scene.

5. Presentation

Sometimes referred to as reporting, this involves detailing the findings of the investigation to all relevant stakeholders, which may include cyber security teams, board members and law enforcement. Because of this, findings must be presented in a clear, easy-to-understand format, which means strong written and verbal communication skills are just as important for digital forensics professionals as technical knowledge.

Browse our latest digital forensics jobs today to take the next step in your cyber security career.