Forensics starts before the incident

Monday, just after seven. Encrypted files appear on a file server. The on-call team acts quickly and, it seems, sensibly: pull the network cable, reboot the server, restore the backup. By midday operations are running again.

Three days later, management asks how the attackers got in, whether they are still in the network and which data may have leaked. Memory has been empty since the reboot, the logs have been overwritten, the system has been rebuilt. The question can no longer be answered, only guessed.

A module for the time before

IT-Grundschutz covers exactly this gap in module DER.2.2 Preparing for IT forensics. It applies once to the entire information domain and does not govern the analysis itself but its preconditions. It describes strategic preparation as a phase of its own, with a sentence that matters most to smaller organisations (our translation):

"It is also necessary if the institution has no forensic expertise of its own."

Three of the fifteen requirements are basic requirements. They are phrased with MUST, so no risk acceptance is possible for them.

• DER.2.2.A1, legal framework: If data is collected and analysed for an investigation, the legal and regulatory framework must be identified and complied with, and the works or staff council and the data protection officer must be involved. Anyone who clarifies this only during the incident loses the hours in which traces are still fresh.
• DER.2.2.A2, guide for initial measures: For the systems in use, it describes what to do in an incident so as to destroy as few traces as possible. It must also describe which actions could destroy potential traces and how to avoid that.
• DER.2.2.A3, pre-selection of forensics providers: Without an in-house forensics team, suitable forensics providers must already be identified in the preparation phase, and the selection must be documented.

Volatile first, then the rest

Why the reboot is the most expensive first move is stated in standard requirement DER.2.2.A8 (our translation):

"The order SHOULD depend on how volatile the data to be secured is."

So first memory, running processes and network connections, then hard disks, and backups last. A reboot reverses this order: it destroys the most volatile first. Pulling the network cable, by contrast, can be right if the guide says so. That is exactly what the guide is for.

Evidence needs a chain

A trace is secured only once it can later be shown to be unchanged. The module therefore requires cryptographic checksums kept separately and in several copies, and, for use in court, a witness who confirms the procedure. The documentation should prove without gaps how the secured original evidence was handled.

Original media belong in a place only named investigators can access, with a defined retention period. Anyone organising this for the first time during the incident does it under time pressure, and that is exactly when chains break.

Three questions for today

• Is there a guide for initial measures, and does the person who has the phone at night know it?
• Does the emergency manual contain the name of a forensics provider, with a reachable number and an agreed engagement?
• Are the works or staff council and data protection involved in advance, or does that coordination only start during the incident?

If you have cyber insurance, put the answers next to the obligations in your policy. What insurers require there and why evidence counts is covered in Insured, as long as you can prove it.

How isidaten represents this

The Forensics & evidence handling module runs the control layer, not the tool: it creates no images and analyses nothing. A readiness check evaluates all fifteen requirements of DER.2.2 against the current state and shows, per requirement, fulfilled, partial, open or not applicable with a reason, for A3 for example whether at least one organisation is flagged as a forensics provider. In the chain of custody, each link depends on the hash of its predecessor, so a later change breaks all following links. A handover requires two different people and the hash value before and after.

The check question

Whom does your on-call team call before rebooting an encrypted server?

If the answer is "nobody", forensics in your organisation is a question for afterwards. By then it is usually too late.

Sources

BSI IT-Grundschutz Kompendium, 2023 edition, module DER.2.2 Vorsorge für die IT-Forensik, sections 1.1 and 1.3 and requirements A1 to A3, A8 and A10 to A12 (German).