This guide explains how to preserve evidence after a cyber attack or ransomware incident, ensuring recovery does not destroy the case.
Guide · 17 pages · 22 min read · Published 2026-08-31
Written for UK lawyers advising clients through cyber-attacks and ransomware incidents, the material addresses the core operational conflict where rapid system recovery destroys crucial forensic evidence. Prepared by the e-Discovery team at Computer Forensics Lab using ISO 17025-aligned procedures, it outlines the immediate technical steps required to capture volatile data, system images, and logs in the first hours before IT estates are rebuilt. The text charts the intrusion story across entry points, lateral movement, data exfiltration, and impact, mapping evidence sources from endpoints and network layers to security tooling and external identity systems. Crucially, it aligns these technical measures with the strict clocks and evidentiary demands of external stakeholders, including the Information Commissioner's Office, regulatory bodies, insurers, and courts governed by CPR Part 35 expert report standards. Complete with worked case examples, red flags, questioning templates for incident response firms, and chain-of-custody guidance, it prepares legal representatives to navigate third-party vendor gaps, evaluate ransom considerations, and construct reliable litigation support even when logs have been cleared or data loss must be disproven.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 22 min read
Understanding how to preserve evidence after a cyber attack or ransomware incident is crucial for UK litigators, in-house counsel, and investigators.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is NCSC incident management guidance, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
INCIDENT EVIDENCE · A GUIDE FOR UK LAWYERS Preserving Evidence After a Cyber-Attack or Ransomware Incident Recovering the Business Without Destroying the Case COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES INCIDENT EVIDENCE PRESERVATION INTRUSION TIMELINE RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: recovery eats evidence 03 The first hours: what to preserve before anything is rebuilt 04 The intrusion evidence map: entry, movement, exfiltration, impact 05 Working with insurers, IR firms and the preservation gap 06 The legal audiences and their clocks: ICO, regulators, subjects, courts 07 From incident to litigation: the uses the estate must support 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PRESERVEBEFOREYOUREBUILD: IMAGES, VOLATILEDATAAND LOGSCAPTUREDINTHEFIRSTHOURSSERVEEVERYAUDIENCETHEINCIDENTCREATES: ANDTHERECOVERYTHATSKIPSPRESERVATIONANSWERSREGULATORS, INSURERSAND COURT S FROM MEMORY
§ 02 · FIRST PRINCIPLES The problem in plain English: recovery eats evidence
§ 03 · THE FIRST HOURS The first hours: what to preserve before anything is rebuilt
§ 04 · THEINTRUSION ' SSTORY The intrusion evidence map: entry, movement, exfiltration, impact
§ 05 · THECROWDEDBRIDGE Working with insurers, IR firms and the preservation gap
§ 06 · THECLOCKS The legal audiences and their clocks: ICO, regulators, subjects, courts
§ 07 · THELONGTAIL From incident to litigation: the uses the estate must support
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PLATFORM CLEARED / END POINT NETWORK SECURIT Y EXTERNAL LAYER LAYER TOOLING LAYER IDENTIT Y / ATTACKER- LOGS LOST
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THE72 - HOURREPORTWRITTENFROMEVIDENCE EXAMPLE2 · THEREBUILDTHATERASEDTHESUPPLIERCLAIM EXAMPLE3 · THENEGATIVETHATWASWORTHPROVING
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client (in the first hours) Ask the IR firm / insurer panel Ask third parties (suppliers, MSPs, providers) SUGGESTED WORDING · PRESERVATION M AN DATE FOR THEIR ENGAGEMENT
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The incident-preservation checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Won't preservation slow down our recovery when every hour of d own time costs money? Should we pay the ransom, and does forensics bear on it? How can we possibly know within 72 hours what data was affected? The attackers cleared the server logs. Is the investigation over? Our insurer's IR firm is handling everything. Do we need our own forensic adviser? Can we prove data was NOT taken?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 27 min read
Macs are susceptible to malware, and Apple's built-in security features, Gatekeeper and XProtect, record activity.
20 pages · 27 min read
Android's openness creates a larger threat surface, making sideloaded stalkerware and malware easier to install.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
