5 scenarios where digital forensics helps a business
Digital forensics isn't only for criminal cases. Five situations where a small business needs to know exactly what happened on a device or account, and what to do first.
By Big Sky Cybersecurity Support
Most of the damage to evidence happens in the first hour, and almost always with good intentions.
Digital forensics sounds like something from a crime show. For a small business, it is much more ordinary: a careful, documented way to find out what happened on a computer, phone or online account, so that an attorney, insurer, regulator or court can trust the answer.
Here are five situations where Montana businesses most often need it, what forensics answers in each one, and what to do first. If you are in the middle of one now, skip to the last section.
1. An employee leaves, possibly with your data
A salesperson resigns to join a competitor. A bookkeeper leaves on bad terms. A week later, a customer mentions they have been contacted by the former employee.
What forensics answers: whether files were copied to USB drives, synced to personal cloud accounts or emailed to personal addresses, which files, and when. It can also show whether the person still has access to company systems.
Do first: keep the returned laptop and phone exactly as they are, and don't reissue them. Disable the person's access, but don't delete the accounts until the data is preserved. Our article on digital forensics in employee misconduct investigations walks through the details.
2. A payment goes to a fraudster's account
A vendor emails new bank details, or the owner appears to ask for an urgent wire. The money goes out, and it is gone. This is business email compromise, and it usually starts with a phished password.
What forensics answers: how the attacker got in, how long they had access, what they read, whether they set up mailbox rules to hide their activity, and whether they still have access. It also builds the timeline your bank, insurer and law enforcement will ask for.
In one Montana case, an organization lost about $70,000 to a fraudulent wire. Its previous IT provider had declared the incident closed, but the attacker kept access for more than a week afterward because sessions were never revoked. The business email compromise case study shows how browser and mailbox artifacts rebuilt the timeline.
Do first: call your bank immediately to try to stop or recall the transfer. Then preserve the mailbox and sign in logs before anyone resets things.
3. Ransomware or a breach, and you have to decide who to notify
Systems are encrypted, or you find signs that an outsider was inside the network. The urgent question after "how do we get running again" is "what did they reach?"
What forensics answers: which systems and records the attacker accessed or took. That answer drives notification decisions under HIPAA and state law, and it supports your insurance claim. Without it, you may have to assume the worst and notify everyone.
Do first: call your insurer and attorney, and don't wipe or rebuild systems until they have been imaged. Our emergency action plan for a data breach lists the first three calls.
4. Harassment or a policy violation in messages
An employee reports harassing texts or chat messages from a coworker, or a manager is accused of sending something inappropriate from a work account.
What forensics answers: what was actually sent, from which account or device, and when, with the metadata that makes the evidence hard to dispute. Screenshots can be edited or taken out of context. A forensic extraction from the device or account can be verified.
Do first: talk to counsel about which devices you can examine, especially personal phones, and preserve company accounts before anyone deletes anything.
5. A dispute over what was sent, received or changed
A former employee says they never received the warning emails. A customer claims a contract was changed after signing. A partner insists a document existed before a certain date.
What forensics answers: whether a message was delivered and opened, whether a file was edited and when, and whether dates on a document match the system records behind it. These questions often settle a dispute before it reaches court.
Do first: put a hold on deleting the relevant mailboxes, files and devices, and let counsel decide what to collect.
What to do in the first hour, whatever the scenario
Most of the damage to evidence happens in the first hour, and almost always with good intentions. Someone opens files to "take a look," resets a password and signs out every session, or wipes a laptop to get it back into service.
- Don't let anyone browse, clean up, wipe or reissue the devices involved.
- Disable access if you must, but don't delete accounts.
- Export or protect cloud logs, which expire on a schedule.
- Write down who has handled each device and when.
- Call your attorney, and your insurer if money or data is involved.
- Call a forensic examiner before anyone else touches the evidence.
Where to start
If one of these sounds like your situation, a short call can tell you whether forensics is needed and what to leave alone in the meantime. Our incident response and forensics team works out of our Great Falls office and serves businesses across Montana.
Common questions
Short answers to the questions we hear most about this topic.
What are two examples of situations where a business might use digital forensics?
Two common ones are a departing employee suspected of taking customer data, and a business email compromise where a payment went to a fraudster. In both, forensics shows what happened, when, and through which account or device, in a way that others can verify.
What digital forensic incidents commonly happen at work?
Data theft by departing employees, business email compromise and wire fraud, ransomware and data breaches, harassment or policy violations involving messages, and disputes over whether an email or document was sent, received or changed.
How is digital forensics different from IT looking at a computer?
IT troubleshooting changes the system as it works, which can alter timestamps and destroy deleted data. A forensic examiner first makes a verified copy, works only from the copy, and documents every step with chain of custody, so the findings can be relied on by counsel, insurers and courts.
Is there a digital forensics provider in Great Falls?
Yes. Big Sky Cybersecurity's forensic and incident response work is run from our Great Falls office, and we serve businesses across Montana. Our analysts are GIAC certified, and incident response is billed at $165 an hour, any hour.
Terms used in this article
Plain definitions, so nothing above needs a second search.
Not sure whether your situation needs forensics?
Same day onsite for contract clients. Everyone else pays $165 an hour, with no emergency surcharge, and gets forensic imaging before remediation.
See incident response and forensicsAll articles