So, you're at the stage now, let's say you've imaged the disks,
you've got copies of the disks.
You've taken copies.
You take copies of RAM as well?
We do.
Yeah, if it's available.
Some systems, it's more difficult,
so we have to take other volatile processes to get the evidence,
but basically, yeah.
Are you looking for their audit log at this stage?
You taking a copy of their Requirement 11,
well no Requirement 10 even, their Requirement 10 audit log?
Are you taking a copy of that or are you going to
come back and look at that later?
It depends on the size of the investigation.
Sometimes, if you've got time, you can actually look at the terminal wall.
You're there, and you can look for common indicators.
You can look at logs if you have a starting date
maybe that you're interested in.
So you can kind of start doing preliminary forensics while you're there.
Other times,
you've got so much data to acquire that you're just going from machine
to machine as fast as you can to get the acquisition done because
you've got a five-day deadline coming up.
I know one of your main goals is to close the incident down.
We use the phrase, contain it, is that the same?
Yeah.
Yeah, yeah, to contain the incident.
In other words, to make sure the bad guys are not there anymore.
Are you starting to do that at this stage or are you going to go
away and do some analysis and come back again?
If we see something we can do to contain it at that point,
we will let the merchant know.
We're not there to redo the systems ourselves,
but we will advise the merchant, hey, we've seen this.
This machine is compromised.
These are the steps you would need to take.
Right, so you're not hands-on fight, you're not doing defense.
You are doing forensics.
You'll advise the merchant how to do defense?
Correct.
Will you advise them to pull in someone's help and do
defense at the same time as you're onsite?
Generally,
we would wait until we are offsite so we're not stepping over each other.
We don't want them to come in and accidently say,
oh wait, we haven't got that machine yet,
and you just wiped it.
And as a PFI, you're only there to do the PFI stuff.
You're not there to do active defense.
Because that might be a surprise to some people.
Yeah, we always provide security recommendations,
some preliminary recommendations,
and then in the final report that describes the incident in detail,
we have some very specific,
as well as general security recommendations to harden those networks.
Yeah, or maybe just be fully compliant with the standards.
Correct.