By Saturday morning the clinic knew it was dealing with ransomware. It didn't know how the attacker got in, how long they had been inside, which systems they controlled, or whether patient records had left the network. Those answers decide what gets contained, how much weight the attacker's claims deserve, and whether thousands of patients must be notified.
On the CompTIA Security+ SY0-801 exam, investigation sits under objective 4.7, which expects you to explain how evidence is gathered and protected during incident response. This lesson covers digital forensics, the order of volatility, chain of custody, preservation, legal hold and e-discovery. The hands-on side, including the data sources investigators use and how memory dumps, bit-level copies and snapshots are made and verified, is covered in Section 31.
Investigation finds out how it happened and how far it reached
Investigation is the phase in which the team establishes the facts: the initial access point, the timeline, every system and account the attacker touched, and what data was viewed or taken. Those facts shape every later phase. Containment has to cover every foothold, not just the one that raised the alert. Negotiation depends on knowing whether the attacker's claims are true. Notification depends on whether regulated data was taken.
The exam's order puts investigation before containment, and there's a real reason: you can't contain what you haven't found. Had the clinic isolated only the file server, the attacker would still have held a domain admin account, a remote-access tool and a working VPN login. In practice the two phases overlap. When encryption is actively spreading, responders isolate the hosts they can see within minutes, as the clinic did, and the investigation runs alongside containment and well past it.
The clinic's cyber insurer assigned a digital forensics and incident response (DFIR) firm on Saturday morning, and breach counsel engaged the firm directly. That arrangement is common because it is intended to keep the work under legal privilege, though courts have sometimes ordered such reports handed over anyway. Within four days the investigators had the outline:
- Day -11: first VPN login with a billing contractor's password, stolen by infostealer malware on the contractor's home PC. That contractor group was exempt from MFA.
- Day -9: the attacker harvests an administrator's credentials from a server's memory, creates an account named svc_backup2 and adds it to Domain Admins.
- Day -8: a remote-access tool is installed on the file server, FS01.
- Days -3 and -2: rclone copies about 38 GB from the billing share to cloud storage, overnight.
- Day 0, 02:10: a scheduled task pushed from domain controller DC01 launches the encryptor.
Digital forensics follows a repeatable process so its findings hold up
Digital forensics is the collection and analysis of digital evidence in a way that can withstand scrutiny, whether from management, a regulator, an insurer or a court. The process is consistent from case to case:
- Identify what evidence exists and where: hosts, logs, cloud consoles, network devices, backups.
- Collect it in order of volatility, with trusted tools, hashing each item at collection.
- Preserve it: originals sealed and stored, analysis done only on verified copies.
- Analyze the copies to build the timeline and answer the investigation's questions.
- Report the findings, the methods used and the evidence each conclusion rests on.
Three habits make the process defensible. Investigators work on copies, never the original, so analysis can't alter the evidence. They hash every item when it's collected and again before each use; a matching SHA-256 value shows the copy is identical to what was collected. And they document everything: who did what, when, with which tool and version. An analyst who can't explain how a file got into the evidence set can't defend a conclusion drawn from it.
At the clinic, the key findings came from three places. The VPN logs showed the contractor account's 1 a.m. logins from a hosting provider, firewall logs showed the overnight transfers, and the memory image of FS01 held the remote-access tool's process and its live connection. Each finding came from a different system, and they had to line up on one timeline, which is why consistent time sources such as NTP matter long before an incident.