When a business detects a security incident, the natural reaction is to want to fix it as fast as possible: restart the server, change the password, close the hole. The problem is that same urgency usually destroys the evidence that would explain what actually happened.
And without that evidence, it's impossible to know whether the attacker is still inside, what they took, or whether the same flaw will be exploited again next week.
Server logs typically rotate and get overwritten within hours or days. RAM memory is lost when the machine is powered off. A simple restart can wipe out exactly the trail needed to understand the attack.
Which evidence disappears fastest
Not all digital evidence has the same "shelf life." Some sources are lost in minutes, others last for weeks. Knowing this helps prioritize what to preserve first:
- RAM memory and running processes. Lost when the machine is powered off — and that's usually where evidence of active malware or attacker connections lives.
- Firewall and access logs. Many systems automatically rotate these logs every few days.
- Active sessions and tokens. They change constantly; without capturing them in time, you lose track of which accounts were compromised.
- File metadata. Can be unintentionally altered by a poorly done copy if the right forensic tool isn't used.
How evidence is properly preserved
In a serious forensic analysis, the process follows a methodology designed to keep the evidence intact and verifiable at every step — not just for the internal report, but in case you ever need to prove exactly what happened.
Isolation and initial logging
The state of the system is documented at the moment of detection: date, time and condition, without shutting down or modifying anything yet.
Forensic acquisition
An exact bit-by-bit copy of the disk and, if possible, RAM memory is created, with cryptographic verification (hashing) that the copy is identical to the original.
Technical analysis
Extraction and analysis using recognized forensic tools (Volatility for memory, Autopsy for disk). Timestamps and metadata are hard to tamper with without leaving a trace.
Timeline report
Reconstruction of what happened, in what order and with what scope, with clear, actionable conclusions to close out the incident.
Situations where this especially matters
Compromised account or system
Understand how attackers got in and what they did inside, before the logs disappear.
Possible information theft
Determine what data was exposed and since when, to assess the real impact.
Infected system
Identify the type of malware, its behavior, and whether it has spread to other machines on the network.
Suspected misuse of corporate systems
Technical analysis of the company device to understand what really happened.
The most expensive mistake: waiting too long
There's a window of time to act. Logs get overwritten, sessions expire, devices get reused. Once evidence disappears, there's no way to recover what no longer exists.
The practical rule: as soon as something looks wrong, isolate without powering off and preserve whatever you can before trying to fix it. The initial consultation is free, and in 30 minutes we can assess what's recoverable and what isn't.
Free feasibility consultation
Tell me the situation in 5 minutes. I'll tell you what evidence can be preserved and how.
Write now →