After a security incident, the same questions arrive from every direction. Management wants to know what happened. Lawyers and insurers want to know what was taken. Regulators may want to know when you found out. The IT team wants to know whether the attacker is still inside. A cyber forensic investigation answers those questions with evidence that holds up, and most investigations are won or lost in the first hour, before anyone has called an expert.
This guide walks through the steps of a digital forensics investigation as the primary guidance describes them: NIST Special Publication 800-86, the internet engineering guideline on evidence collection (RFC 3227) and ISO/IEC 27037. It is written for IT and security teams who need to act correctly before, during and after an incident, not as legal advice.
The short answer: a cyber forensic investigation follows four phases defined by NIST SP 800-86: collection, examination, analysis and reporting. In practice that means deciding early whether evidence may be needed for legal or disciplinary action (if unsure, preserve it), capturing volatile data such as network connections and memory before anything is shut down, copying disks and logs, proving with hash values that the copies match the originals, recording a chain of custody, working only on copies, building a timeline across hosts and logs, and writing a report that states what was done and what was found.
Forensics and incident response: how they fit together
NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, takes what it calls an IT view rather than a law enforcement view. Forensics is a set of techniques that serves incident response: it tells responders how the attacker got in, what they touched and whether they are gone. NIST’s incident response guidance, SP 800-61 Revision 3 (April 2025), places that work inside the Cybersecurity Framework (CSF) 2.0.
The difference shows up in the care taken. A responder who only needs to restore service can reimage a machine. A responder who may need the evidence later, in court, in an employment dispute, for an insurer or for a regulator, must collect it in a way that can be defended. SP 800-86 says to decide this before collection starts, with management and legal advisors, and to preserve evidence by default when the answer is unclear. For the detailed handling rules, see our guide to digital evidence preservation.
The four phases of a forensic investigation
NIST SP 800-86: each phase turns what it receives into something more useful
- 1. CollectionMediaIdentify, label, record and acquire data, preserving its integrity
- 2. ExaminationDataExtract the relevant data from the media with forensic tools
- 3. AnalysisInformationAnswer the questions that started the investigation
- 4. ReportingEvidenceDescribe what was done and found, and what should change
Before an incident: forensic readiness
The best investigations start months earlier. Evidence you never logged cannot be collected.
- Central logging with enough retention. Logs kept only on the host can be deleted by the attacker or overwritten. The 2025 joint SIEM guidance from the Australian Cyber Security Centre, CISA and partner agencies suggests a starting point of at least one year for administrative and security logs and 90 days for informational logs.
- Synchronized clocks. A timeline across ten systems is only as good as their clocks. Use one time source and record time zones.
- A prepared toolkit on trusted, write-protected media, with tools tested in advance. NIST’s Computer Forensics Tool Testing program publishes test results for disk imaging, write blockers and other tool types.
- Names and numbers: legal counsel, an outside forensic firm, your cyber insurer and the relevant law enforcement contact, agreed before you need them.
- Written procedures for who may decide to preserve evidence, isolate machines or call outside help.
The steps of a digital forensics investigation
Step 1: Secure the scene and set the goal
Write down what you know, when you learned it and who is involved. Decide, with counsel where needed, whether this could become a legal, disciplinary or insurance matter. Then stop well-meant damage: do not reboot, reimage, run a full antivirus scan or log in to look around. Each of these can change or destroy files, memory and logs. If the machine must be contained, cut its network access rather than its power. Photograph physical setups and note what is on screen.
Step 2: Collect volatile data first
Volatile data disappears when a system shuts down or simply as time passes. SP 800-86 recommends collecting it in this order, because network connections time out and login sessions change, while configuration and time change slowly:
Order for collecting volatile data from a live system
First to last, as recommended in NIST SP 800-86, section 5.2.1.3
Run collection tools from your own trusted media, not from the suspect machine, and record every command you run and when. Remote collection tools such as Velociraptor can gather the same data from many machines at once.
Step 3: Acquire disks, cloud data and logs
For disks, make a bit-for-bit image, using a hardware or software write blocker so the original is not changed. Where full imaging is impractical, for example a large server or a cloud workload, collect targeted copies: specific volumes, snapshots or folders. Do not forget data that lives elsewhere: firewall, VPN, DNS and proxy logs, email logs, Microsoft 365 and cloud audit logs, and your SIEM. Many of these roll over on a schedule, so export the relevant period early. NIST notes that even log files are only partly stable, because new events overwrite old ones.
Step 4: Verify integrity with hash values
Compute a cryptographic hash (a digital fingerprint) of each original and each copy, and confirm that they match. Record the values. This is how you show later that the evidence has not changed. In US federal courts, the 2017 amendments to the Federal Rules of Evidence added Rule 902(14), which lets data copied from a device be authenticated by a “process of digital identification”, in practice a matching hash, through a written certification.
Step 5: Keep a chain of custody
SP 800-86 describes what a chain of custody needs: a log of everyone who had custody of each item, what they did with it and when, secure storage when it is not in use, and examination performed only on copies, with the integrity of both original and copy verified. ISO/IEC 27037 adds the same discipline for each stage it covers: identification, collection, acquisition and preservation.
Step 6: Examine the data
Examination extracts what matters from what was collected: file systems and deleted files, Windows event logs and registry, Linux authentication and audit logs, browser history, scheduled tasks and services, memory structures, and cloud audit records. Automated tools do most of the extraction. Analysts decide where to look and confirm what the tools report.
Step 7: Analyze and build a timeline
Analysis answers the questions that started the investigation. Merge events from hosts, network devices and cloud services into one timeline, in one time zone, and work through:
- How did the attacker get in, and when?
- Which accounts did they use or create?
- Which systems did they reach, and how did they move between them?
- What data did they access, and did any leave the network?
- What did they leave behind to get back in?
- Is any of it still active?
Mapping each finding to a technique in MITRE ATT&CK, the public catalog of attacker behavior, helps responders check for related activity the attacker usually performs next.
Step 8: Report
SP 800-86 describes the report as covering the actions performed, the analysis, what other actions are needed and recommended improvements to policies, procedures and tools. Write for your audiences: a short summary for leadership, a detailed technical record for responders, and a factual, neutral version for counsel. Keep the evidence and the report for as long as legal holds, contracts and regulations require.
Evidence sources and what they answer
| Source | What it can show | How quickly it disappears |
|---|---|---|
| Memory | Running malware, network connections, credentials in use | At shutdown |
| Endpoint disk | Files, deleted files, programs run, persistence, browser activity | Slowly, but every login changes it |
| Windows and Linux logs | Logins, account changes, services, commands | Days to weeks, when local logs roll over |
| Firewall, VPN, DNS and proxy logs | Remote access, connections to attacker servers, data leaving | Often days on the device itself |
| Cloud and Microsoft 365 audit logs | Sign-ins, mailbox rules, file downloads, admin changes | Set by the provider’s retention for your plan |
| SIEM | All of the above, centrally, with the original events | As long as your retention policy allows |
Tools commonly used at each step
| Step | Free and open source examples |
|---|---|
| Remote collection and triage | Velociraptor (AGPL-3.0) |
| Memory analysis | Volatility 3 (Volatility Software License) |
| Disk examination | Autopsy and The Sleuth Kit |
| Timelines | Plaso, also called log2timeline (Apache 2.0) |
| Log search across systems | A SIEM, such as UTMStack (AGPL-3.0) |
Commercial forensic suites cover the same steps with more automation and vendor support. Whatever you use, test it before an incident and record its version in your notes.
Mistakes that ruin investigations
- Rebooting or reimaging the machine before collecting volatile data.
- Running a full antivirus scan first, which can quarantine or delete the very files you need to examine.
- Examining the original disk instead of a verified copy.
- Letting firewall, VPN or cloud logs roll over while the investigation is being organized.
- Mixing time zones in the timeline.
- Not writing down who did what, when, which turns good evidence into contested evidence.
- Calling counsel or the insurer only after the evidence is gone. Check your cyber insurance policy now: some require prompt notice or the insurer’s approved forensic firm.
How a SIEM supports a forensic investigation
We build UTMStack, so weigh our view accordingly. A SIEM does not image disks or capture memory, and UTMStack does not either: use the tools above for that. What it adds is the record that survives the host. When an attacker clears a Windows security log, the copy already sent to the SIEM remains, and UTMStack has a built-in rule that raises an alert when that log is cleared.
- Retention up to 5 years, with older logs in a cold tier that stays searchable without restoring a snapshot.
- Log search in plain text or SQL across every source, for building the timeline.
- Alerts linked to their raw events, and incidents that keep linked alerts, notes, actions and history in one record.
- Containment that keeps evidence: response flows can isolate a host through the agent, cutting it off the network while it stays powered on for memory collection.
- Help when your team is stretched: UTMStack’s SOC Extension service backs up your existing analysts during incidents, nights and weekends.
For the wider response process, see our guide to security incident response. You can try the live demo with no sign-up, or install the free Community edition.
Frequently asked questions
What is a cyber forensic investigation? The collection, examination and analysis of digital evidence after a security incident, done in a way that preserves its integrity, to establish what happened, how and who was involved.
What are the steps of a digital forensics investigation? NIST SP 800-86 defines four phases: collection, examination, analysis and reporting. In practice: secure the scene, collect volatile data, acquire disks and logs, verify hashes, keep a chain of custody, examine, build a timeline and report.
What is the order of volatility? The order in which to collect evidence, from the data that disappears fastest to the data that lasts. NIST recommends network connections and login sessions first, then memory, processes, open files, network configuration and system time.
Should I turn off an infected computer? Usually not straight away. Shutting it down destroys memory and network state. Disconnect it from the network instead, then collect volatile data, unless an expert or your procedure says otherwise for that situation.
What is a chain of custody? A written record of everyone who handled each piece of evidence, what they did and when, which shows that it was not altered.
Do I need an outside forensic firm? For a suspected breach of personal data, a ransomware attack or anything that may go to court, it is usually wise, and your insurer may require one of its approved firms. Your own team’s job is to preserve the evidence until they arrive.
Sources
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response (forensic phases, chain of custody, order of volatile data collection)
- NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025
- RFC 3227: Guidelines for Evidence Collection and Archiving
- ISO/IEC 27037:2012: Guidelines for identification, collection, acquisition and preservation of digital evidence
- Federal Rules of Evidence, Rule 902, including 902(14) and the 2017 committee notes
- NIST Computer Forensics Tool Testing program
- Implementing SIEM and SOAR platforms: practitioner guidance, ASD’s ACSC, CISA and partners, May 2025 (log retention starting points)
- Tools: Velociraptor, Volatility 3, Autopsy, The Sleuth Kit and Plaso
