Incident Investigation & Technical Report
When you need to know what happened, not just make it stop. We reconstruct the incident from logs, files and database, remove what the attacker left behind, and document it in a technical report.
Who this is for
- Businesses that must explain an incident to management, a client or an insurer.
- E-shops and applications handling customer or payment data, where "it is clean now" is not a sufficient answer.
- Sites where the cleanup already happened once and the questions remained: how, since when, what was accessed.
Incident Investigation & Technical Report
Starting price for one website or application on one hosting account, with logs available. Confirmed in writing after the scoping call.
What's included
- Evidence preservation first: full copy of files, database and available logs before anything is changed.
- Timeline reconstruction from web server, panel, mail and application logs.
- Identification of the entry point where the evidence supports it, and a clear statement where it does not.
- Full inventory of persistence: backdoors, rogue accounts, cron jobs, database payloads, modified core files, other affected accounts on the same server.
- Indicators of compromise: file hashes, attacker IP addresses, domains, user agents, timestamps.
- Complete cleanup of everything found, with the same care as the Malware Removal service.
- Technical report plus a one-page summary written for non-technical readers.
What's not included
- Legal advice or formal evidence handling for court proceedings. We document to a professional standard, but we are not a licensed forensic laboratory.
- Recovery of data that no longer exists on the server or in backups.
- Long-term monitoring after the incident. See Maintenance & Security Monitoring.
How we work
The order matters. Evidence is preserved before cleanup, so the report is based on what was actually there.
Scoping call and accessday 1
Short call to understand what you observed and what you need the report for. We list the access and logs we require and confirm the price band in writing.
Evidence preservationday 1
Files, database and every available log are copied into an evidence folder with hashes. Nothing is cleaned yet.
Analysisdays 2–4
Timeline from logs, file system and database review, decoding of obfuscated payloads, mapping of every persistence layer, check of other accounts and services on the same server.
Cleanup and verification
Everything found is removed or restored. Second pass and external verification confirm the site is clean.
Report and walkthroughtypically 5–10 business days total
You receive the technical report and the summary. We walk you through it on a call and answer questions from your team, host or insurer.
What you receive
- Technical report: scope, timeline, entry point assessment, persistence inventory, indicators of compromise, actions taken, open risks.
- One-page executive summary in plain language.
- Indicator list in a machine-readable format (CSV) for your host, firewall or SIEM.
- Clean, verified site and preserved evidence archive (kept 30 days unless agreed otherwise).
- Follow-up call to go through the findings.
What changes the price
- Number of sites, accounts or servers involved.
- Log availability: when logs were rotated or deleted, reconstruction takes longer and conclusions are narrower. We say so in the report.
- Customer or payment data involvement, which widens the scope to data access questions.
Frequently asked questions
What is the difference between this and the Malware Removal service?
Malware Removal answers "what is on the site and how do we remove it". Incident Investigation also answers "how did it get there, since when, and what did the attacker do" and documents it in a report written for third parties. Cleanup is included in both.
Can you always find the entry point?
Not always. It depends on how long the logs go back and whether the site was modified before we arrived. When the evidence does not support a firm conclusion, the report says so and lists the most likely candidates with the supporting facts. We do not invent certainty.
I already cleaned the site. Can you still investigate?
Often yes, but with less to work from. Logs usually survive a cleanup; the malicious files frequently do not. If you still have a backup from before the cleanup, keep it and tell us. We wrote an article about exactly this situation, linked below.
Is the report suitable for an insurer?
It is written to be: factual, dated, with evidence references and a clear separation between what was observed and what was inferred. Whether it satisfies a specific insurer depends on their requirements, which we are happy to review with you before starting.
Do you need access to the whole server?
The wider the access, the more complete the picture. For a single site, panel plus SSH/SFTP plus database is usually enough. For server-level questions (other accounts, root compromise) we need root or an administrator with us on the session.
Can the investigation be done without taking the site offline?
Yes. Evidence is copied, not moved. If the site is actively harming visitors (redirects, card skimming) we recommend containment first, and we discuss that on the scoping call.
Related reading
From our research notes
Need the full picture?
Describe what you observed and what the report is for. We reply with the access we need and a scoping call slot.