Breach Forensics

Conducting Breach Investigation Forensics

Overview

When a personal data breach is confirmed, a thorough forensic investigation is essential to determine the breach scope (which personal data and data subjects were affected), the attack vector, the timeline of unauthorized activity, and the root cause. The investigation findings directly feed into the Art. 33 supervisory authority notification, the Art. 34 data subject communication, and the post-breach remediation plan. This skill provides the complete forensic investigation workflow, evidence handling procedures, and analysis techniques.

Evidence Preservation Protocol

Golden Rule: Preserve First, Analyze Second

The first priority upon breach confirmation is to preserve volatile evidence before it is overwritten or destroyed. Evidence must be collected in order of volatility:

1. CPU registers and cache — captured via live memory acquisition tools (Volatility, WinPmem, LiME).
2. Memory (RAM) contents — full memory dump of affected systems. Contains running processes, network connections, encryption keys, and malware artifacts that may not exist on disk.
3. Network connections and routing tables — current active connections may reveal command-and-control (C2) infrastructure or ongoing data exfiltration.
4. Running processes and services — process trees, loaded DLLs, open file handles, and user context.
5. Disk contents — forensic disk images (bit-for-bit copies) of affected system storage. Use write blockers for physical media.
6. Log files — system logs, application logs, security logs, database audit logs. Prioritize logs that may be subject to rotation or overwrite.
7. Network traffic captures — packet captures (PCAP) from network taps, SPAN ports, or inline capture points.
8. External evidence — cloud service logs (AWS CloudTrail, Azure Activity Log), SaaS audit logs, third-party vendor logs.

Forensic Image Acquisition

Chain of Custody Documentation

Every piece of evidence must be tracked from acquisition through analysis to storage using a formal chain of custody record:

Evidence Tracking Fields

Chain of Custody Transfer Record

Log Analysis Methodology

Tool Selection and Application

Splunk Enterprise Security

• Use case: Centralized log correlation, timeline reconstruction, behavioral analysis.
• Key searches for breach investigation:
  • Authentication events: index=auth sourcetype=okta:log action=authentication.login | stats count by user, result, client.ipAddress, client.geographicalContext.country
  • Database queries: index=database sourcetype=postgresql:audit query_type=SELECT table IN (customers, transactions, accounts) | stats count, values(query_text) by user, source_ip
  • Data exfiltration: index=network sourcetype=pan:traffic dest_zone=untrust bytes_sent>50000000 | stats sum(bytes_sent) by src_ip, dest_ip, app

ELK Stack (Elasticsearch, Logstash, Kibana)

• Use case: Large-volume log ingestion, full-text search, visualization of access patterns.
• Key queries for breach investigation:
  • Anomalous access timing: Filter by timestamp outside of business hours (before 07:00 or after 20:00 local time) against personal data system indices.
  • Geo-anomaly detection: Aggregate authentication source IPs by geolocation; flag countries not present in the 90-day baseline.
  • Volume anomaly: Aggregate data access events by user per hour; identify spikes exceeding 3 standard deviations above the 30-day mean.

Wireshark / tshark

• Use case: Packet-level analysis of network traffic to/from compromised systems.
• Key filters for breach investigation:
  • Identify data exfiltration: ip.src == 10.0.1.50 && tcp.dstport != 443 && frame.len > 1000 (non-HTTPS outbound from compromised host)
  • Identify C2 communication: dns.qry.name contains ".onion" || dns.qry.name contains "dga" (DNS queries to suspicious domains)
  • Reconstruct data transfers: Follow TCP streams to recover transferred file contents from PCAP captures.

Additional Tools

Scope Determination Process

Step 1: Identify All Compromised Systems

1. Starting from the initially identified compromised system, trace lateral movement through authentication logs, network connection logs, and endpoint detection alerts.
2. For each system identified, determine whether it stores, processes, or transmits personal data by cross-referencing with the data processing inventory (Art. 30 records).
3. Document each compromised system with: hostname, IP address, function, data classification, personal data categories stored, and estimated data subject count.