What Forensic Evidence to Require From Your Incident Response Firm

Key takeaways

• Evidence is a deliverable, not a byproduct. Decide before you sign what artifacts the firm must collect, preserve, and hand over.
• Chain of custody is what makes the evidence usable. Insurers, regulators, and courts all ask who handled what and when. A firm that cannot answer that in writing has collected suggestions, not evidence.
• Ask for the raw artifacts, not just the report. A report is an opinion. The images, memory captures, and logs behind it are the facts.
• Forensic certifications belong to named people. Ask which analysts on your engagement hold GCFA, GCFE, or GNFA, and let those claims be checked against the issuer's registry.
• Put it in the RFP. Evidence requirements stated in the procurement are enforceable. Evidence requirements stated after the breach are a negotiation.

The six evidence deliverables to require

1. Evidence preservation and chain of custody

The moment work starts, the clock starts on evidence handling. Require the firm to document, for every artifact: what was collected, from where, by whom, at what time, and how it was stored and transferred. Hashes prove an artifact was not altered. This record is the chain of custody, and it is what makes evidence usable in an insurance claim, a regulatory filing, or a court.

NIST published the standard reference for this discipline, SP 800-86, a guide to integrating forensic techniques into incident response. You do not need to read it. You need your firm to be able to say they follow it.

2. Forensic images and memory captures

Ask for full disk images and memory captures of the key systems, taken at defined points in the response. A live system changes every second it runs; an image freezes the facts. Memory in particular holds what an attacker had in hand: credentials, tools, and running code that leave no trace on disk after a reboot. If the firm only worked on live systems and kept no images, most of that is gone.

3. Log collection, stated in advance

Require the firm to say which log sources they will collect and preserve: endpoint telemetry, authentication logs, firewall and proxy records, DNS, and cloud audit logs if you run in the cloud. Logs age out. Retention windows measured in days are common. The firm's first operational job in your incident is to stop the bleed of evidence, and that means exporting the logs before anything else.

4. A timeline with cited artifacts

The core analysis deliverable is a timeline of attacker activity, event by event, with each entry pointing at the artifact that supports it. This is the difference between a narrative and a finding. A timeline that says "the attacker moved laterally on day two" is a story. A timeline that says "pass-the-hash activity observed at 03:14, from image HV01, authenticated by log entry X" is evidence.

5. Root cause and attack path

The evidence deliverables feed one question your board and your insurer will ask: how did they get in? Require the answer to be stated with the same artifact citations, including what was first compromised, how access moved, and what the attacker touched. The answer drives both the claim and the fix.

6. Remediation evidence

Containment claims need proof too. Require the firm to document what was removed, what was rebuilt versus restored, what was hardened, and the evidence that the attacker's access was actually cut off. An incident is not closed when the alerts stop. It is closed when the evidence shows the attacker is out.

Certifications: check the holders, not the org

Forensics is specialist work, and the credentials that mark it belong to individuals: GIAC's GCFA (forensic analyst), GCFE (forensic examiner), and GNFA (network forensics). A firm that says "certified team" should be able to name the people and the certificates. Our directory registry-checks named holders where firms have them on record, and the same expectation is reasonable of any firm you evaluate in depth.

Say it in the RFP

Evidence requirements belong in procurement, in writing. The questions to require answers to:

1. Which log sources will you collect and preserve, and how fast?
2. What is your chain of custody standard, and who signs it?
3. Which systems will you image, and when do you capture memory?
4. What artifacts do you hand over at close, in what format?
5. Which named analysts will hold the forensic certifications on this engagement?

The cloud incident response RFP asks the evidence questions directly: required log sources, chain of custody standards, and the forensic artifacts you expect at close. Firms answer in writing before you compare them.

Related reading

• How to choose an incident response firm, the full six-check evaluation, of which evidence discipline is one.
• DFIR vs MDR: what a forensic response actually covers, and what a monitoring service does not.
• The post-incident review guide: where this evidence goes after the response ends.
• The verified DFIR directory, with each firm's documented engagements and evidence tier.