The Forensic Trail: What Happens After a Corporate Data Breach

A corporate data breach is not an event. It is a process — one that, by the time it is discovered, has typically been underway for weeks or months. The average dwell time of an attacker inside a compromised network exceeds 200 days. What organisations do in the immediate aftermath of discovery determines whether they recover or deteriorate.

Hour Zero: Containment Before Everything

The instinct of many organisations upon discovering a breach is to immediately purge affected systems. This instinct is operationally catastrophic from a forensic standpoint. Wiping systems before forensic images are captured destroys the evidence trail permanently.

The Forensic Evidence Hierarchy

• RAM contents: Process lists, network connections, decrypted data, and attacker tools
• Network artefacts: Active connections, ARP caches, and routing tables
• System logs: Authentication events, process execution records, and file access logs
• File system artefacts: Modified, created, and deleted files
• External evidence: Email headers, cloud service logs, and third-party telemetry

Attribution: Separating Signal from Noise

Sophisticated threat actors deliberately plant false flags. Credible attribution requires corroboration across multiple independent evidence streams. Premature public attribution is a serious liability.

Chain of Custody: Evidence That Survives Court

If a breach results in criminal conduct, forensic evidence may need to withstand scrutiny in civil or criminal proceedings. Every action taken on evidential material must be logged. Forensic images must be cryptographically verified.

Remediation Without Repetition

Organisations that patch the known entry point without understanding the full scope of attacker activity frequently find themselves breached again through a secondary foothold that was never identified.