When a data breach occurs, the immediate instinct of any IT team is to contain the damage: isolate the system, restore the environment, and get back up and running as quickly as possible. That instinct is understandable. And in many cases, it is exactly what destroys any possibility of legal accountability later. A data breach investigation follows a different logic from conventional incident response. It requires certain evidence to be preserved before any technical intervention takes place, and that preservation must follow specific protocols so that the collected material has evidentiary value in court. In this article, you will understand why the first actions taken after an incident determine what can later be proven, which mistakes irreversibly compromise evidence, and what needs to happen before the technical team touches the affected systems. Enjoy the read.
The Problem Starts Before the Forensic Investigation
Most companies that experience a data breach have never thought about what they will need to prove afterward.
Prove that unauthorized access occurred. Prove who was responsible. Prove that the company had adopted the security measures required by the LGPD before the incident. Prove that the damage was caused by a third party and not by internal negligence.
Each of these points depends on digital evidence collected at the right time and in the right way. And the window for doing this correctly is small, sometimes only minutes.
What Is Digital Evidence and Why Is It Fragile?
Digital evidence is any data stored or transmitted in electronic form that can be used to establish facts in a judicial or administrative proceeding. Access logs, authentication records, file metadata, captured network traffic, command execution history.
The problem is that this type of material can be easily altered or disappear. A rebooted system overwrites volatile-memory logs that will no longer exist when someone decides to look for them. A disk formatted to restore the environment eliminates traces that could identify the incident’s entry vector. A rushed system update can modify timestamps that were the only way to establish the attack timeline.
None of these actions were taken with the intention of destroying evidence. They were taken to solve the problem. From a legal standpoint, the result is the same.
The Most Common Mistakes That Invalidate an Investigation
There is a recurring pattern in cases that reach a forensic investigation after a security incident: the evidence that would have solved the case was altered or destroyed within the first few hours by people who were trying to help.
Rebooting or Shutting Down Affected Systems Without Prior Capture
A running system’s RAM contains information that exists nowhere else: processes active at the time of the incident, established network connections, credentials in use, and fragments of malicious code that have not yet been written to disk.
When the system is rebooted or shut down before a forensic capture, all of this material disappears permanently. It is one of the most common mistakes and one of the hardest to overcome afterward.
Accessing Systems Using Tools from the Environment Itself
When someone uses the compromised system to investigate what happened, each access modifies file timestamps, changes usage records, and potentially overwrites disk space where relevant data was stored.
A forensic investigation requires external tools and imaging processes that do not alter the original. A forensic copy created using the proper protocol generates a cryptographic hash that proves the material was not modified after collection. Without this process, any evidence presented can be challenged by any party interested in questioning its integrity, as established by ISO/IEC 27037, the international standard for the collection and preservation of digital evidence.
Communicating the Incident Internally Before Containing the Breach
When information about an incident circulates internally without proper controls, there is a real risk that people directly or indirectly involved may take actions to cover their tracks before the investigation begins. This is not necessarily intentional, but the effect on the evidence is the same.
The proper protocol is to limit information about the incident to the smallest possible group of people until the initial forensic collection has been completed.
Restoring the Environment From Backup Before the Forensic Investigation
Restoring from a backup is the natural response when the goal is to resume operations quickly. From a forensic standpoint, it is one of the worst decisions that can be made before evidence is collected.
The compromised environment contains information about how the incident occurred that will not be present in the backup. The entry vector, modified files, and access activity following the intrusion: all of this exists in the system’s current state and will cease to exist as soon as the backup replaces that state.
What Needs to Happen in the First Few Minutes
The order of actions taken during the first few minutes of incident response determines what can later be investigated and proven. There is a sequence that must be followed before any technical intervention is made in the environment.
The first step is to isolate the affected systems from the network without shutting them down. This prevents the incident from spreading and preserves the current state of memory for subsequent capture.
The second is to engage a team with forensic capabilities before taking any other technical action. Not the internal IT team, which has a natural incentive to restore the environment as quickly as possible, but professionals trained to collect evidence without altering what needs to be preserved.
The third is to document everything observed before any intervention: which system exhibited anomalous behavior, when it was identified, who identified it, and what actions had been taken up to that point.
This initial record is part of the chain of custody that will support any subsequent use of the evidence in a judicial or administrative proceeding.
What the Investigation Needs to Deliver
A data breach investigation conducted using an appropriate forensic protocol must be able to answer specific questions using traceable evidence.
How did the unauthorized access occur: what was the entry vector, whether it was a compromised credential, an exploited vulnerability, or an internal action. When did it happen: the timeline of the incident, from the initial access to the moment it was identified. What was accessed or exfiltrated: which data was accessed, copied, or transmitted outside the environment. Who was involved: whether there is evidence pointing to internal or external responsible parties.
Each of these answers must be supported by evidence collected with verifiable integrity. An expert report that cannot explain how it reached its conclusions or that presents material with a compromised chain of custody can be challenged before its merits are even considered.
Why This Matters Beyond Litigation
A forensic investigation of a data breach is not only useful for legal proceedings. It is also relevant to notification to the ANPD, which requires a description of the incident within three business days of becoming aware of the event, pursuant to Resolution CD/ANPD No. 15/2024.
It serves to demonstrate technical diligence in administrative proceedings, where the difference between a company that properly investigated the incident and one that simply restored the environment can determine the difference between a warning and a fine based on the company’s revenue.
And it serves to help the company understand what actually happened, because without a proper forensic investigation, the root cause of the incident is rarely identified with enough precision to ensure that it will not happen again.
STWBrasil conducts forensic investigations into security incidents using traceable collection protocols, documented chain of custody, and structured reports designed for use in judicial and administrative proceedings and regulatory notifications. If your company has experienced an incident or wants to understand how to prepare its environment for an appropriate response, talk to our team.
