When Information Security Fails: How Digital Forensics Reveals What Really Happened

Information security tells you that something went wrong. Digital forensics tells you what, how and how far. In the first 24 hours, you need both.

Your firewall was up to date. Your staff had completed their awareness training. Multi-factor authentication was switched on. And yet, on an ordinary Monday morning, someone notices that a mailbox has been quietly forwarding messages to an unknown address for three weeks.

This is the moment most information security strategies never plan for. Everything before it is about prevention. Everything after it is about answers: what happened, how the attacker got in, which data was affected and whether it is still going on. More security will not answer those questions. Digital forensics will.

In short: Digital forensics is the structured process of preserving, analysing and documenting digital evidence after a security incident. It allows an organisation to establish what happened, meet its reporting duties under NIS2 and the GDPR, and support every finding with evidence that stands up to scrutiny. Information security tries to stop incidents; digital forensics explains them.

I. No Information Security Is Perfect

It is tempting to treat a security incident as a failure of the security team. The numbers suggest something else: incidents are close to inevitable, even for organisations that do most things right.

1. According to Bitkom's Wirtschaftsschutz 2026 study, 87% of German companies were hit by data theft, industrial espionage or sabotage in the past twelve months, and a further 9% suspect they were. Cyberattacks account for around three quarters of the resulting damage.

1. According to the IBM Cost of a Data Breach Report 2026, as reported by Computer&Automation, the average cost of a data breach in Germany is €4.25 million, and it still takes organisations around 160 days to detect and contain a breach.

The reasons are familiar. Stolen credentials. A convincing phishing email. An insider with legitimate access. A misconfigured cloud share. A supplier whose systems were compromised first. Increasingly, attacks assisted by AI that are faster and more convincing than before.

Preventive architecture matters, and we have written about where it typically goes wrong in Zero-Trust: What Mid-Market German Firms Get Wrong. But even a well-built zero-trust model reduces the likelihood of an incident. It does not reduce it to zero. The question is not only how do we stop it? It is also what do we do when it happens?

II. Where Digital Forensics Comes In

Information security and digital forensics are two halves of the same discipline. One looks forward and builds defences. The other looks back and establishes facts.

After an incident, a forensic investigation answers four questions that every management board, regulator and insurer will ask:

1. What happened? Forensic examiners reconstruct a timeline from log files, file system metadata, emails and memory. Why it matters: without a timeline, every other decision is a guess.

2. How did the attacker get in? Identifying the initial access point, whether a stolen password, a phishing link or an unpatched server. Why it matters: you can only close the door you know about.

3. What was affected? Which systems, which files and, above all, whose personal data. Why it matters: this decides whether you must notify the data protection authority and the people concerned.

4. Can you prove it? Every finding is documented with a verifiable chain of custody. Why it matters: the same evidence may later be needed by regulators, insurers, auditors or a court.

It is worth separating forensics from incident response. Incident response contains the damage and restores operations. Digital forensics establishes the facts. The two work best together, which is why Germany's Federal Office for Information Security (BSI) treats IT forensics as a discipline of its own, alongside incident handling. Restore too quickly without preserving evidence, and you may never learn how the attacker got in, or whether they are still there.

III. The Clock Is Ticking: NIS2 Gives You 24 Hours

Since Germany's NIS2 implementation law entered into force on 6 December 2025, without a transition period, thousands of organisations in 18 sectors must report significant security incidents to the BSI on a strict schedule, as set out in the EU NIS2 Directive.

1. Within 24 hours: an early warning. Is the incident suspected to be malicious? Could it have cross-border impact?

2. Within 72 hours: an incident notification with an initial assessment of severity and impact, plus indicators of compromise.

3. Within one month: a final report, including the root cause, the type of threat and the measures taken.

On top of that, if personal data is involved, Article 33 of the GDPR requires notification of the supervisory authority within 72 hours. Under NIS2, failures to comply can cost essential entities up to €10 million or 2% of global annual turnover.

The BSI accepts that an early warning will be incomplete. Speed comes first. But every later stage asks for facts, and the final report asks for the one thing you cannot invent after the event: the root cause. In NIS2 Six Months In: What German Businesses Still Get Wrong, we noted that incident-response testing is one of the areas enforcement is moving towards. Forensic readiness is the part of that test most organisations have never practised.

You cannot write a credible root-cause report about evidence you destroyed on day one.

IV. The First Hours Decide What You Can Prove

Most evidence is not lost to attackers. It is lost to well-meaning colleagues in the first hours of an incident. The instinct to switch everything off, clean it up and get back to work is understandable. It is also the fastest way to make an investigation impossible.

1. Do not switch it off: Working memory holds running processes, active network connections and sometimes encryption keys. All of it disappears at shutdown. Instead, isolate the system from the network and leave it powered on.

2. Do not wipe and rebuild yet: Restoring from backup is the right goal, but take a forensic image first. Once a disk is overwritten, the evidence on it is gone.

3. Do not investigate on the live system yourself: Every click, search and opened file changes timestamps and metadata that examiners rely on.

4. Image storage media through a hardware writeblocker: A writeblocker makes sure the original drive cannot be modified while a bit-for-bit copy is made. Matching hash values then prove the copy is identical to the original.

5. Document everything: Who touched which device, when and why. This chain of custody is what turns data into evidence.

6. Keep evidence out of public tools: Uploading suspicious emails, log files or documents to a public AI chatbot or online scanner is a data transfer in its own right, often of exactly the data the attacker was after.

If you are unsure, the safest first step is simple: isolate, do not touch, and call in forensic specialists.

V. Keep the Investigation Under Your Control

Investigation data is often the most sensitive data an organisation will ever hold. It contains the breached information itself, plus employee communications, credentials and internal assessments of what went wrong. Handing it to a US-headquartered cloud service raises the same jurisdictional questions we covered in Data Sovereignty in Europe: Why It Matters More Than Ever, and it makes the chain of custody harder to defend the moment evidence leaves your control. The safest forensic workflow is one where the evidence never leaves infrastructure you, or a European provider you trust, control.

VI. How Sinabis Helps

Whether you lead compliance, run IT security or investigate incidents for a living, Sinabis covers the full forensic chain, from the first piece of evidence to the final report, with hardware, software and services developed in Germany.

1. Preserve: The Sinabis Writeblocker enforces write protection in hardware; the SATA model is NIST-tested. X64 Forensic secures devices, systems and formats to forensic standards and produces court-admissible expert reports.

2. Process: Sinacluster, our investigation data platform, brings mixed sources together in a German data centre, reconstructs timelines and keeps a full audit trail. It has been independently penetration-tested by SySS.

3. Analyse: Sinabis Inspector searches millions of emails, documents and forensic images (E01, AD1) in seconds. Sinabis Assistant lets investigators ask questions in plain language and returns the source passage with every answer. For incidents involving payment fraud, Sinabis Tracer analyses financial transactions. Where data must never leave the building, everything runs fully offline on Sinabox.

4. Secure the rebuild: Once the facts are clear, X64 Systems supports network infrastructure, cybersecurity and secure hosting, so the same incident does not happen twice.

Frequently Asked Questions

1. What is the difference between information security and digital forensics?

Information security aims to prevent incidents through measures such as firewalls, access control and staff training. Digital forensics comes into play after an incident: it preserves, analyses and documents digital evidence to establish what happened, how it happened and what was affected.

2. What should you do immediately after a security incident?

Isolate the affected systems from the network but leave them switched on, do not wipe or rebuild anything yet, avoid working on the affected devices yourself, document every step and contact forensic specialists. Under NIS2, an early warning to the BSI is due within 24 hours.

3. Do I need digital forensics to meet NIS2 reporting requirements?

NIS2 does not prescribe a method, but the final report due within one month must describe the root cause, the type of threat and the measures taken. Without forensically preserved evidence, the root cause is very difficult to establish reliably.

4. Should I switch off a compromised computer?

Usually not. Shutting down erases volatile data in working memory, such as running processes, network connections and encryption keys. The recommended approach is to disconnect the device from the network and leave it running until forensic specialists can secure the data.

5. How do you prove that digital evidence has not been altered?

By combining a hardware writeblocker, hash values and a documented chain of custody. The writeblocker prevents any changes to the original drive while a forensic copy is made. Matching hash values, a unique digital fingerprint, prove the copy is identical to the original. The chain of custody records who handled the evidence, when and why.

Information security protects you from most incidents. Digital forensics protects you from the one that gets through, by turning a crisis into facts.

Facing an incident right now, or want to be prepared before one happens? Get in touch here. Or see how Sinabis protects client data and handles secure data processing.

→ Learn more: www.sinabis.com

Sinabis Analytics GmbH · X64 Forensic GmbH · X64 Systems GmbH