Cyber Forensics: What It Proves and How an Investigation Runs

Cyber forensics is the identification, preservation, collection, and analysis of digital evidence about a security incident, done so the findings hold up when a regulator, insurer, opposing expert, or court tests them. An investigation answers six questions: what happened, how the attacker got in, when, what they touched or took, whether they still have access, and who was responsible, to the extent the evidence supports attribution. It differs from incident response, which stops the attack, and from eDiscovery, which produces documents for litigation. The method is what makes the findings defensible. Investigators collect the most volatile evidence first, such as memory and the cloud sign-in logs that Microsoft Entra ID keeps for only 7 or 30 days, verify every copy by hash, record chain of custody, and use tested tools under guidance such as NIST SP 800-86 and ISO/IEC 27037.

What questions does a cyber forensics investigation answer?

Every investigation starts from the questions someone has to answer, and those questions set the scope. After a suspected breach, counsel needs to know whether personal data was acquired, because notification statutes turn on that fact. After ransomware, leadership needs to know whether the attacker still has access before systems come back online. In an insider case, HR and counsel need to know which files left, when, and by what route. Across cases, the questions resolve into six findings: the initial access vector, the timeline, the systems and data touched, what left the environment, whether persistence remains, and who was responsible.

Attribution needs the most care. Evidence can tie activity to an account, a device, an IP address, or the known tools and infrastructure of a criminal group, and that is often enough for a business or legal decision. Naming an individual or a state sponsor takes considerably more, and a careful report says exactly where the evidence stops. The terms in this field overlap: computer forensics traditionally meant examining a single computer, digital forensics covers any digital evidence, and cyber forensics, as used here, means digital forensics applied to attacks, intrusions, and data theft.

How is cyber forensics different from incident response and eDiscovery?

The three disciplines share tools and evidence, and they serve different audiences with different questions. NIST SP 800-61 Rev. 3, published in April 2025, treats incident response as part of an organization's cybersecurity risk management under the NIST Cybersecurity Framework 2.0. eDiscovery is a litigation process, which the Electronic Discovery Reference Model divides into stages running from identification and preservation through review, production, and presentation. Forensics sits between them and turns incident data into findings that can be tested later.

In practice the work overlaps. A responder isolating a host should capture its memory before anyone reboots it, and the eDiscovery team will later rely on the forensic images and chain of custody the investigation produced.

What evidence does a cyber forensics investigation use?

Evidence falls into six groups, and most investigations draw on several of them. Disk evidence comes from forensic images of laptops, servers, and virtual machine volumes, which preserve files, deleted file remnants, and the operating system's own records of activity. Memory evidence comes from a capture of RAM on a running system, which shows running processes, network connections, and malicious code that never wrote itself to disk. Network evidence includes firewall, VPN, proxy, and DNS logs and any packet captures, which show connections into and out of the environment.

Cloud and SaaS evidence now carries many cases. Microsoft 365 records mailbox and file activity in its unified audit log, Microsoft Entra ID records sign-ins, Google Workspace keeps admin, Drive, Gmail, and login audit logs, AWS records API activity in CloudTrail, and Azure records subscription-level changes in its activity log. Mobile evidence comes from phones and tablets, through an extraction from the device or from its cloud backup. Email evidence spans message content, the headers that trace a message's route, and server records such as Exchange Online message trace. A business email compromise investigation may never need a laptop image, because the sign-in logs, mailbox audit records, and message headers hold the evidence.

Why does the order of evidence collection matter?

Evidence disappears at different speeds, so the collection order decides what survives. RFC 3227, the 2002 guidelines for evidence collection and archiving, tells investigators to proceed from the volatile to the less volatile: registers and cache first, then routing tables, the process table, kernel statistics, and memory, then temporary file systems, then disk, then remote logging and monitoring data, then physical configuration and network topology, and archival media last. NIST SP 800-86 gives the same advice: in many cases, acquiring volatile data should take priority over non-volatile data.

Memory comes first because a shutdown or reboot erases it, along with the running malware, the attacker's open sessions, and sometimes the only copy of a payload that never touched disk. Short-retention logs come next, and in cloud environments they are often the most perishable evidence of all. Microsoft Entra ID keeps sign-in logs for 7 days on the free tier and 30 days on P1 and P2. AWS CloudTrail event history covers 90 days of management events unless a trail or event data store was set up in advance. The Windows Security event log defaults to a 20 MB maximum and overwrites its oldest events when it fills, so the history it holds depends on how busy the system is. Extending retention after the fact does not restore events that were already deleted, which is why the first hours of an investigation go to exporting logs.

Volatility is one input to the collection plan. Investigators also weigh how central each source is to the questions and whether collecting it changes other evidence. Running a memory capture tool alters the system slightly, so examiners record the tool, the time, and the reason, which lets another examiner judge the effect later.

How does a cyber forensics investigation run?

NIST SP 800-86 describes four phases: collection, examination, analysis, and reporting. ISO/IEC 27037:2012 covers the front end in more detail, with guidelines for the identification, collection, acquisition, and preservation of digital evidence. Its companions from 2015 cover the rest: ISO/IEC 27041 addresses assurance that investigative methods are fit for purpose, ISO/IEC 27042 the analysis and interpretation of digital evidence, and ISO/IEC 27043 the investigation process as a whole. In practice an engagement runs in six steps.

1. Identification means listing the devices, accounts, cloud tenants, and log sources that could hold relevant evidence, and who controls each one.
2. Preservation means stopping routine deletion: suspending reimaging, placing mailboxes on hold, extending log retention, and isolating affected hosts from the network without powering them off.
3. Collection means acquiring forensic images, memory captures, and log exports, computing a hash of each, and recording who handled each item and when.
4. Examination means processing the collected data to extract what is relevant, such as parsing event logs, recovering deleted files, and indexing mailboxes.
5. Analysis means building one timeline across endpoints, identity, email, and cloud logs and testing each hypothesis against it until the findings are supported.
6. Reporting means stating each finding, the evidence for it, the methods and tools used, and the limits of what the evidence shows.

Three safeguards make results defensible. Chain of custody records every person who handled an item of evidence. Hashing proves that a copy matches its source: the examiner computes a cryptographic hash, such as SHA-256, of the original and the copy and confirms the values match. Federal Rule of Evidence 902(14), added in 2017, allows data copied from a device or file to be authenticated through a qualified person's certification of that process of digital identification, which in practice means a matching hash. Tool validation is the third safeguard. NIST's Computer Forensics Tool Testing program develops methods for testing forensic software, the Department of Homeland Security shares the resulting test reports publicly, and a firm should be able to explain how it validated the tools behind each finding.

Which forensic artifacts prove what?

An artifact is a record a system creates as a side effect of normal operation. No single artifact proves a case. Each establishes a narrow fact, and conclusions come from how those facts line up on a timeline. The table covers common artifacts and what a non-specialist should know about each.

The Microsoft 365 records matter more than they did a few years ago. Microsoft added records of mail items accessed, mail items sent, and user searches in Exchange Online and SharePoint Online to Purview Audit (Standard), which keeps audit records for 180 days, and CISA published an implementation playbook for those expanded logs in January 2025. Those records separate an attacker who read a mailbox from one who only signed in to it. Investigators then map what they find to MITRE ATT&CK technique IDs, as our MITRE ATT&CK guide describes, so the report speaks the same language as the detection team that has to close the gaps.

When do companies need a cyber forensics investigation?

The common triggers are a suspected breach of personal data, a ransomware attack, an employee who may have taken data on the way out (covered in our guide to departing employee data theft), payment or invoice fraud, HR misconduct involving company systems, litigation that turns on what a computer did, a regulator's inquiry, and a cyber insurance claim that needs documented cause and scope. Each one ends in a decision that someone outside the company will review: a notification, a lawsuit, a termination, a filing, or a claim.

Some of those decisions put privilege in play. When litigation or regulatory exposure is likely, outside counsel often retains the forensic firm so the work supports legal advice, an arrangement our guide to Kovel agreements explains. Whether a report stays privileged is a decision for counsel and, if it is challenged, for a court, and how the engagement is set up from the first call affects the answer. Once a dispute is reasonably anticipated, the duty to preserve evidence also applies, which our litigation hold guide covers.

How much does a cyber forensics investigation cost?

Cost follows scope. The drivers are the number of devices and custodians, the number of cloud tenants and log sources, data volume, how much evidence was preserved before the investigation started, the deadline, and whether the findings need a formal expert report or testimony. The ranges below are BD Emerson planning ranges as of October 2026 for investigation fees, excluding legal fees and remediation work.

Expert reports and testimony are scoped and billed separately, because their scope depends on the litigation. Preparation lowers the cost of every scenario in the table: logs with long retention, EDR on every endpoint, and a forensic firm whose engagement paperwork is settled before the incident.

How do you choose a cyber forensics firm?

Ask five questions before you sign. First, which methods does the firm follow, and can it show its procedures for acquisition, hashing, and chain of custody against NIST SP 800-86 and ISO/IEC 27037? Second, how does it validate its tools, and does it confirm important findings with a second tool or a second data source? Third, has it testified, and are its reports written to meet Federal Rule of Evidence 702, which since its 2023 amendment requires the party offering an expert to show the court that it is more likely than not that the testimony meets the rule's reliability requirements? Fourth, how does it work under privilege: will it sign a Kovel letter, route drafts through counsel, and keep the forensic file separate from remediation work? Fifth, does it work at the level of the specific logs your cloud and SaaS platforms produce, or only on disk images?

Also ask who will do the work. The examiner who will defend the findings should have performed or directly supervised the analysis, because opposing counsel will ask that question too.

How BD Emerson runs forensic investigations

We scope each investigation around the decision it has to support, whether that is a notification analysis, a termination, an insurance claim, or a lawsuit, and we agree at the start who directs the work. When counsel is involved, we do Kovel work: we work at the direction of outside counsel, deliver drafts and findings through counsel, and keep remediation advice on a separate track. Privilege and work product calls belong to counsel and, ultimately, the court. Our examiners preserve volatile evidence first, hash and log every item, and build one timeline across endpoints, identity, email, and cloud logs. Each report states the findings, the evidence behind each one, and where the evidence stops.

Our practitioners have testified as expert witnesses in court. We take testifying engagements selectively; most of our litigation work is as consulting experts retained through counsel. When an investigation starts during a live attack, it runs alongside our incident response services, and the full scope of the work is on our digital forensics services page.

Frequently asked questions

What is cyber forensics? Cyber forensics is the identification, preservation, collection, analysis, and reporting of digital evidence about a security incident or misuse of systems, done so the findings can withstand review by regulators, insurers, opposing experts, and courts. It answers how an attacker got in, when, what they accessed or took, whether they still have access, and, where the evidence allows, who was responsible.

What is the difference between cyber forensics and computer forensics? Computer forensics traditionally means examining individual computers and storage media. Cyber forensics applies the same evidence-handling discipline to attacks and intrusions, which now involve cloud identity logs, SaaS audit records, network logs, and memory as well as disks. The method is the same in both: preserve first, verify copies by hash, keep a chain of custody, and use tested tools.

Should you turn off a computer that has been hacked? Disconnect it from the network and leave it running. Shutting a system down erases its memory, which can hold the attacker's running tools and open connections. CISA's ransomware guidance tells responders to isolate affected systems immediately and to power devices down only if they cannot be disconnected from the network. Capture memory before anyone reboots or reimages the machine.

What does a forensic investigation report include? A forensic report states the questions investigated, the evidence collected and how it was preserved, the tools and methods used, a timeline of relevant activity, each finding with the evidence behind it, and the limits of what the evidence shows. Reports meant for litigation also record chain of custody and hash values so another examiner can reproduce the work.

Who should hire the forensic firm, the company or its lawyers? When litigation, regulatory action, or notification decisions are likely, outside counsel often retains the forensic firm so the work supports legal advice, usually under a Kovel arrangement. When the goal is purely operational, the company can retain the firm directly. The choice affects whether the report can be protected, and that decision belongs to counsel, so involve counsel before anyone signs a statement of work.

How do you know forensic tool results are reliable? Reliability comes from validated tools and repeatable methods. NIST's Computer Forensics Tool Testing program develops test methods for forensic software, examiners verify every copy against its original by hash, and important findings are confirmed with a second tool or a second data source. A defensible report names each tool and version so another examiner can reproduce the result.

If you need to find out what happened on your systems and the answer has to hold up later, our digital forensics team can preserve the evidence, run the analysis, and report the findings to you or your counsel.