Digital Forensics

Many organisations initially focus on how an attacker gained access to a system. While understanding the initial compromise is important, it is only one aspect of a breach, and not always the one with the most immediate importance. Frequently, the most important question is what were they able to do after they got in.

A compromised user account may have little practical impact if it had limited permissions. Conversely, a seemingly minor breach can become significant if it grants access to sensitive information, critical systems, or administrative privileges. Our forensic investigations focus on understanding the real operational consequences of an attack. We always keep in mind that what matters most is obtaining information that can usefully help remediate or respond to damage caused by an attack.

Computers continuously record evidence of their own operation. Logs, file modifications, authentication events, network traffic, running processes, backups, and countless other sources of information can help reconstruct past activity.

By correlating information from multiple systems, it is often possible to build a timeline of events and determine how an incident unfolded. Shellhex focuses on transforming fragmented technical information into a coherent account of what occurred. The goal is to obtain the clearest possible understanding of an attack: when and how attackers first gained access, how they moved through an environment, what systems they interacted with, and whether they remain present.

Digital forensics is valuable even when no confirmed breach exists. When security operations centres or IT teams observe unusual behaviour or suspicious activity, digital forensics can be an appropriate response. In other cases, a previous security assessment may indicate the possibility of compromise without providing definitive answers. Digital forensics can even add value simply when organisations need to resolve uncertainty about the state of their system, as a complement to our services such as our Technical Security Review offering. In all of these situations, forensic techniques can be used proactively to investigate systems, identify indicators of compromise, and establish confidence in the integrity of an environment.

Every successful attack reveals something about the systems it affected. Security incidents expose weaknesses that may not have been apparent during normal operation and often reveal unexpected interactions between technical systems and human processes. Forensic analysis therefore serves a purpose beyond understanding a specific incident. It can also provide valuable insight into how future incidents can be prevented, detected more quickly, or contained more effectively.

Our analysis spans the layers an investigation requires. On the host, we examine disk and memory for the artefacts that record what truly happened - system and event logs, execution traces, file-system timelines, and the residue that attackers routinely leave despite their efforts to clean up - and we reconstruct a timeline of activity from them. We prioritise preserving ephemeral data - imaging systems and capturing volatile memory before it is lost. Memory forensics is frequently decisive, since much modern malware exists primarily in memory and never touches disk in a form a simple scan would catch. Across the network, we analyse captured traffic and flow data to identify command-and-control channels, lateral movement, and the tell-tale signatures of data exfiltration. Across your logs, we correlate events from disparate sources into a single coherent narrative, the picture no individual system reveals on its own. We place emphasis on maintaining a documented chain of custody for all forensic data we process.

Shellhex's Digital Forensics service incorporates malware analysis. If malware is present on your systems, it's vital to understand what it is, what it does, how it persists, and what it was trying to achieve. We analyse malware both statically and in a controlled dynamic environment. In addition to providing insight into the nature of an attack, malware analysis can provide the signatures of compromise you need to detect the same threat elsewhere in your systems.

Our Digital Forensics offering can be scoped according to your organisation's need. If desired, we can include reconstruction of an incident, assessment of the impact of a breach, development of a timeline of an attack, identification of attacker activity and persistence mechanisms, analysis of malware and suspicious software, remediation recommendations, and support for wider Incident Response and Security Engineering activities.