{"id":11754,"date":"2021-05-21T10:52:00","date_gmt":"2021-05-21T08:52:00","guid":{"rendered":"https:\/\/usd.formwandler.rocks\/security-analysis-pentests\/digitale-forensik\/"},"modified":"2021-08-03T15:04:39","modified_gmt":"2021-08-03T13:04:39","slug":"digital-forensics","status":"publish","type":"page","link":"https:\/\/www.usd.de\/en\/security-analysis-pentests\/digital-forensics\/","title":{"rendered":"Digital Forensics"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" width=\"100%\" custom_padding=\"0px||70px||false|false\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\" width=\"100%\" custom_padding=\"0px||||false|false\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"default\" text_text_color=\"#FFFFFF\" text_font_size=\"30px\" text_line_height=\"1.2em\" header_font=\"Roboto||||||||\" header_text_color=\"#F07F1D\" header_font_size=\"50px\" background_image=\"https:\/\/www.usd.de\/wp-content\/uploads\/usd-analysis-header-forensik.jpg\" custom_margin=\"-31px||0px||false|false\" custom_padding=\"166px|60px|62px|60px|false|true\"]<\/p>\n<h1 style=\"text-align: center;\">Digital Forensics<\/h1>\n<p style=\"text-align: center;\">The analysis following an incident<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"RGBA(0,0,0,0)\" custom_margin=\"0px|0px|28px|0px|false|true\"]<\/p>\n<p><span>Have you been hit by a cyber-attack and need help clearing things up? Our team of experienced computer forensics experts can help with identifying the cause, scope and perpetrator of the attack for you. Furthermore, we advise you on communication issues and create regulatory or compliance-specific reports for you, if required.<\/span><\/p>\n<p>[\/et_pb_text][et_pb_button button_url=\"\/en\/security-analysis-pentests\/contact-form\/\" button_text=\"Contact us\" _builder_version=\"4.9.4\" _module_preset=\"7d5eca5e-7ccf-4359-a023-e8404a31180a\"][\/et_pb_button][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"default\"]<\/p>\n<h2>Key questions about incident investigation<\/h2>\n<p>Our technical incident investigation focuses on answering the following questions:<\/p>\n<ul>\n<li>How did the attack happen? Which vulnerabilities were exploited?<\/li>\n<li>Which systems have been affected by the attack?<\/li>\n<li>What damage was caused and which data has been stolen?<\/li>\n<li>Who was the perpetrator?<\/li>\n<li>How can future attacks be prevented?<\/li>\n<\/ul>\n<h2><\/h2>\n<h2>Our approach<\/h2>\n<p>Our forensic investigation comprises six phases. This procedure is based on international standards and best practices such as SANS, NIST and the BSI standards [BSI \u2013 Bundesamt f\u00fcr Sicherheit in der Informationstechnik \u2013 in English: German Federal Office for Information Security]. All the phases and their results are documented accordingly. After the incident analysis has been completed, you will receive an extensive forensic report with recommendations on how to prevent attacks in the future. Furthermore, we issue you with any regulatory notifications that might be required.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_accordion open_toggle_background_color=\"#FFFFFF\" closed_toggle_background_color=\"#FFFFFF\" icon_color=\"#F07F1D\" use_icon_font_size=\"on\" icon_font_size=\"23px\" _builder_version=\"4.9.4\" _module_preset=\"default\" body_font=\"|300|||||||\" body_font_size=\"16px\" custom_margin=\"4px|0px|-1px|0px|false|true\" border_radii=\"on|5px|5px|5px|5px\" border_color_all=\"#F6F6F6\" box_shadow_style=\"preset1\" box_shadow_spread=\"-11px\" box_shadow_color=\"rgba(0,0,0,0.22)\"][et_pb_accordion_item title=\"Nicht bearbeiten!\" open=\"on\" _builder_version=\"4.9.4\" _module_preset=\"default\" custom_css_main_element=\"display: none;\"]<\/p>\n<p>Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.<\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Preparation\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>In the preparation phase, we discuss the current situation with you and explain our course of action. Depending on the incident, we identify and make suitable forensic tools available.<\/span><\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Data Collection\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>In this step we collect all the important data of potentially affected components. For this purpose, we record the current system time and date, all the processes currently running on the system (system status), the opened network connections (sockets) and the users logged on the system, etc.<\/span><\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Examination\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>Once data collection is finished, we start examining it. In this process, we extract all the data relating to the incident. The amount of data is reduced by the fact that certain data can be excluded from further analysis (e.g. by checking against known checksums). However, it might also be required to extend the analysis to further components of the IT equipment.<\/span><\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Data Analysis\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>Very often, several subcomponents are affected by an incident, thus necessitating multiple individual examinations of them. Combining the results from these examinations to a coherent timeline and logical connection is the subject of the data analysis phase.<\/span><\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Documentation\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>Formal reporting of the investigation results takes place after data analysis. In doing so, our computer forensic experts combine the individual steps that have been recorded in the course of the investigation into one or more reports. We prepare target group specific reports, which means that the technical details in the report for the management are different from those for the system administrator, for example. In this phase, we also assist you in preparing regulatory notifications, if required.<\/span><\/p>\n<p>[\/et_pb_accordion_item][et_pb_accordion_item title=\"Post-processing\" closed_toggle_text_color=\"#3C3C3C\" _builder_version=\"4.9.4\" _module_preset=\"default\" border_radii=\"on|5px|5px|5px|5px\" closed_toggle_font=\"|300|||||||\" closed_toggle_font_size=\"16px\" toggle_text_color__hover_enabled=\"on|hover\" toggle_text_color__hover=\"#F07F1D\" open_toggle_text_color__hover_enabled=\"on|hover\" open_toggle_text_color__hover=\"#F07F1D\" open=\"off\"]<\/p>\n<p><span>Within the scope of post-processing, we offer optional identification of processes needing improvement. We recommend and provide you with technical action plans to help prevent future attacks and develop specific proposals with you for improving the corporate response strategy, namely the process of handling incidents within the company.<\/span><\/p>\n<p>[\/et_pb_accordion_item][\/et_pb_accordion][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#F07F1D\" custom_margin=\"40px|auto||auto||\" custom_padding=\"20px|20px|20px|20px|true|true\" border_radii=\"on|5px|5px|5px|5px\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"default\" text_text_color=\"#FFFFFF\" header_text_color=\"#FFFFFF\" header_2_text_color=\"#FFFFFF\" header_3_text_color=\"#FFFFFF\"]<\/p>\n<h2>What to do in case of an emergency<\/h2>\n<p>&nbsp;<\/p>\n<h3>Leave everything unchanged<\/h3>\n<p><span>Of course, the primary concern in most cases is to reduce the damage and to re-establish normal operation as soon as possible after a security incident. However, from a security point of view, the affected system should not be directly reinstalled after each and every incident, because this often means that the cause of the incident remains unknown and the system is still vulnerable to new attacks. Changes to the system should therefore be avoided in order not to jeopardize the investigation of the cause.<\/span><\/p>\n<p><span><\/span><\/p>\n<h3>Record everything that has happened<\/h3>\n<div class=\"x-main left\" role=\"main\">\n<article id=\"post-18993\" class=\"post-18993 page type-page status-publish hentry no-post-thumbnail\">\n<div class=\"entry-wrap\">\n<div class=\"entry-content content\">\n<div id=\"cs-content\" class=\"cs-content\">\n<div class=\"e18993-28 x-section\">\n<div class=\"e18993-32 x-container max width\">\n<div class=\"e18993-36 x-column x-sm x-1-2\">\n<div class=\"x-text\">\n<p><span>Document what happened when, and what you did. This information is extremely valuable for the work of our computer forensic team.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/article>\n<\/div>\n<aside class=\"x-sidebar right\" role=\"complementary\">\n<div id=\"text-54\" class=\"widget widget_text\">\n<div class=\"textwidget\">\n<div class=\"e cs-content x-global-block x-global-block-19496\">\n<div class=\"e19496-1 x-section\">\n<div class=\"e19496-2 x-container max width\">\n<div class=\"e19496-3 x-column x-sm x-1-1\">\n<div class=\"e19496-4 x-text x-text-headline\">\n<div class=\"x-text-content\">\n<div class=\"x-text-content-text\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Digital Forensics The analysis following an incidentHave you been hit by a cyber-attack and need help clearing things up? Our team of experienced computer forensics experts can help with identifying the cause, scope and perpetrator of the attack for you. Furthermore, we advise you on communication issues and create regulatory or compliance-specific reports for you, [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":15265,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-11754","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/pages\/11754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/comments?post=11754"}],"version-history":[{"count":0,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/pages\/11754\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/pages\/15265"}],"wp:attachment":[{"href":"https:\/\/www.usd.de\/en\/wp-json\/wp\/v2\/media?parent=11754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}