Reconstruct a security incident
Build an event timeline from supportable technical evidence.
Short answer: For IT losses and cyber incidents, the technically supportable event sequence is reconstructed from system states, logs, versions and other artefacts. The examination separates observed effects, possible causes and unsupported assumptions.
Separate loss event, technical state and cause
The visible impact of an IT loss is not automatically its technical cause. Data loss, outage, misconfiguration, software fault, unauthorised access or ransomware can produce similar effects but leave different evidence.
A technical examination therefore reconstructs the supportable system state, aligns timelines and log sources, and tests competing causes. Where logs are missing or states have already changed, the remaining uncertainty is stated explicitly.
Typical reasons for an assignment
- after cyber incidents such as unauthorised access, ransomware, manipulation or anomalous account and system activity
- in cases of data loss, system outage or software faults where the technical path to the event should be reconstructed
- when differing timestamps, logs, backups, version states or incident records must be reconciled
- when an independent technical finding is required for claims handling or further review without deciding coverage or liability
Typical technical questions
- What can be established technically as having occurred, and when?
- Which systems, accounts, datasets or software states were affected?
- Which logs, configurations or artefacts support the asserted causal chain?
- Were backup and recovery mechanisms demonstrably present and tested?
- Which alternative technical causes remain compatible with the available evidence?
Examination scope: The examination can assess the technical event sequence, system states and cause hypotheses. It does not decide insurance coverage, liability, policy obligations, fraud or claims settlement.
From IT loss event to a bounded technical cause finding
Loss and incident examination chain
From IT loss event to a bounded technical cause finding
2
Preserve the state
Collect logs, configurations, versions, data states and volatile evidence systematically.
4
Bound the finding
Document supportable event chain, data gaps, detection limits and unresolved alternatives.
A technical cause finding does not determine coverage or liability. It documents the supportable technical event sequence and its limitations.
Typical examination material
- Incident records, logs, SIEM or monitoring data and account activity
- System, network and cloud configurations and access-control states
- Software versions, patch states, dependency information and deployment records
- Backups, restore tests, snapshots and data-state evidence
- Endpoint, file, metadata and forensic artefacts where available
What you receive
- a technical reconstruction of the supportable event sequence
- a documented attribution of relevant system states, timelines and artefacts
- an assessment of competing technical cause hypotheses and evidence gaps
- clear technical statement boundaries for claims or further specialist review
Relevant service areas
Relevant knowledge for preparation and deeper review
Evaluate log data
Interpret log sources, time references and detection limits.
Backup and recovery evidence
Separate the existence of backups from demonstrated restorability.
Patch and dependency states
Reconstruct component and update states over time.
Timestamps and metadata
Classify time sources and version attribution carefully.
Integrity and evidence chain
Distinguish integrity, identity and provenance of digital artefacts.
Statement and decision boundary: The investigation describes the technical event sequence, evidence and cause hypotheses. It does not decide insurance coverage, liability, policy obligations, fraud or legal consequences.
Frequently asked questions
Can a technical examination identify the cause of every cyber incident?
No. The achievable depth depends on preserved logs, system state and other evidence. Missing evidence must remain an explicit limitation.
Does an available backup prove that recovery was possible?
No. The existence of a backup and demonstrated restorability are separate technical findings.
Does the expert determine insurance coverage?
No. Coverage and legal consequences are not technical findings and remain outside the technical assessment.
Prepare the IT loss or cyber incident
For an initial review, a short event chronology, affected systems and an overview of available logs, backups and incident records are especially useful. Evidence preservation should take precedence over premature technical conclusions.
Send enquiry