A cyber investigation is the structured process of establishing what happened during an online or digital incident, what systems or accounts were affected, what evidence exists, how the incident should be contained and which organisation has the authority to take the next step. It may involve account records, emails, website logs, payment evidence, device data, open-source intelligence, digital forensics and witness information — but lawful authority and evidence preservation are as important as technical skill.
At Trojan Investigations, we help clients separate three jobs that are often confused: restoring security, investigating the facts and reporting crime or regulatory breaches. Those jobs overlap, but they are not identical and may require different specialists.
Published: 20th July 2024 | Updated: 4th September 2026
What Should You Do First After a Cyber Incident?
- use a known-safe device or communication channel if the normal network may be compromised;
- record when and how the issue was discovered;
- preserve suspicious emails, messages, logs, alerts and transaction records;
- contain immediate harm without unnecessarily wiping or altering evidence;
- identify which accounts, systems, people and data are affected;
- activate the organisation's incident-response plan and bring in the right technical, legal, management and communications people;
- assess whether the incident must be reported to the NCSC, ICO, police, Action Fraud, insurers, sector regulators or other bodies; and
- keep a decision log as facts emerge.
Do not begin by deleting everything suspicious. A rushed clean-up can remove the evidence needed to understand the incident.
The ONS computer-misuse figure and government business survey use different populations and methodologies, so they should not be added together. They demonstrate the scale of the problem from different perspectives.
Cyber Incident, Cybercrime and Data Breach Are Different Questions
An incident can be technically serious without amounting to a criminal offence. A cybercrime can occur without a reportable personal-data breach. A personal-data breach can also arise accidentally rather than through an attacker.
| Issue | Example | Primary question |
|---|---|---|
| Cyber security incident | Compromised account, malware or service disruption | How do we contain, recover and understand the technical cause? |
| Cybercrime | Unauthorised access, fraud or malicious interference | What offence may have occurred and what evidence should be reported? |
| Personal-data breach | Unauthorised disclosure, access, loss, alteration or destruction of personal data | Does UK data-protection law require notification and risk mitigation? |
| Commercial dispute | Employee or contractor misuses credentials or confidential data | What contractual, employment, civil or criminal route is appropriate? |
Why Evidence Preservation Comes Before Attribution
Clients often want to know “who did it?” immediately. Attribution is usually the hardest part of a cyber investigation because accounts, infrastructure and identities can be borrowed, compromised, spoofed or deliberately obscured.
The first objective should therefore be preserving what can be proven: timestamps, account activity, message headers, transaction references, access records, screenshots with context, original files, device state and relevant communications.
Attribution should be built from corroborating evidence rather than one IP address, username or location indicator.
What Evidence Can a Cyber Investigation Use?
Depending on the incident and lawful access, useful evidence may include:
- email headers and original message files;
- cloud-account security logs and authentication history;
- website and server access logs;
- payment, invoice and banking evidence held by the client;
- domain and company-registration information;
- publicly available social-media and forum activity;
- device or forensic images provided with lawful authority;
- security alerts from endpoint, firewall and identity systems;
- witness accounts and internal chronology; and
- records from service providers obtained through proper legal or law-enforcement channels.
Private Investigators Do Not Have Police Cyber Powers
A private investigator cannot compel an internet provider to disclose subscriber data, demand account records from a platform, seize a device, obtain a search warrant or hack a suspect's account. Those powers either do not exist for private investigators or require proper legal process and public-authority involvement.
Lawful access is a core part of the investigation
Unauthorised access to computer material can engage the Computer Misuse Act 1990. A legitimate cyber investigation must therefore distinguish between data the client lawfully controls, public information, material supplied by authorised parties and information that requires legal or law-enforcement powers.
Cybercrime Against Businesses Is Often Ordinary Fraud With a Digital Route
Business email compromise, fake invoices, supplier impersonation and credential theft can look highly technical while the ultimate objective is simple: make a person send money, reveal a password or approve an unauthorised transaction.
The investigation should therefore combine technical evidence with commercial context. Who expected the invoice? Who could see the transaction? Did the attacker know a real supplier relationship? Was the email account compromised or was a lookalike domain used? Did payment details change unexpectedly?
Our business investigation services can support the non-technical parts of that enquiry, including timelines, identities, companies, relationships and lawful background research.
Online Harassment, Impersonation and Individual Cyber Cases
Individuals may need help with fake profiles, anonymous harassment, catfishing, account takeover, threatening messages or reputational attacks. These cases require careful preservation because content can be deleted, edited or moved between platforms.
A private investigator can help organise evidence and connect publicly available information, but immediate threats, stalking, extortion, intimate-image abuse or other serious crime should be referred to police and appropriate safeguarding services.
Our personal investigation services can be considered where there is a legitimate, lawful objective that does not require public-authority powers.
Incident Response and Investigation Must Run Together
The NCSC's July 2026 guidance for highly disruptive attacks divides recovery into immediate activities, recovery and ongoing investigations, and rebuild. That reflects a practical reality: organisations must restore operations while also preserving enough evidence to understand the compromise.
A clean rebuild is essential for security, but if it is done before relevant logs, images or configuration information are preserved, the investigation may lose its best evidence.
1. Contain
Limit the attacker's access, isolate affected systems where appropriate and secure critical credentials through trusted channels.
2. Preserve
Capture logs, alerts, messages, configurations, account activity and device evidence before avoidable changes remove them.
3. Analyse
Build the timeline, identify entry points, affected assets, persistence and likely objectives.
4. Report
Determine which public authorities, regulators, insurers, customers or contractual partners need to be notified.
5. Recover and learn
Rebuild securely, remove the root cause, update controls and test whether the organisation could detect a repeat incident.
Reporting to the NCSC Does Not Replace Regulatory Reporting
The NCSC's Cyber Incident Signposting Service says organisations may need to notify multiple bodies because different organisations have different remits. Reporting to the NCSC is useful for technical assistance and national threat understanding, but it does not fulfil separate legal or regulatory obligations.
The NCSC also advises not to submit an incident report using a network you believe is compromised.
The ICO 72-Hour Rule Needs Fast Facts, Not Perfect Facts
If a personal-data breach is likely to result in risk to individuals' rights and freedoms, the organisation must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach is likely to create a high risk, affected individuals may also need to be informed without undue delay.
The ICO also requires organisations to keep a record of personal-data breaches whether or not a particular breach is reportable. That makes an accurate incident log valuable from the first hour.
The 72 hours starts when the organisation becomes aware
Waiting for complete forensic certainty can create a reporting problem. Organisations should establish the facts quickly, assess risk, document decisions and make an initial notification when required, updating it later as more information becomes available.
Ransomware and Extortion Require Multi-Disciplinary Decisions
A ransomware incident is not only an IT problem. It can affect business continuity, personal data, contracts, insurance, law enforcement, sanctions exposure, public communications and evidential preservation.
Senior management, cyber specialists, legal advisers, insurers and relevant authorities may all need to be involved. An investigator should not advise a client to communicate with attackers in a way that creates additional legal or operational risk.
How Open-Source Intelligence Supports Cyber Investigations
OSINT can help identify reused usernames, connected domains, company records, public profiles, infrastructure clues and patterns across incidents. The strength comes from correlation, not from assuming that any one matching identifier belongs to the same person.
Investigators should account for copied content, fake profiles, compromised accounts and false attribution. A public username match is a lead, not proof of identity.
Digital Forensics Is a Specialist Evidence Discipline
Where the question depends on the contents of a phone, computer, storage device or cloud account, specialist digital forensic work may be needed. The forensic objective is to preserve and analyse data in a controlled way, document the method and explain the limitations.
For criminal-justice forensic activities in England and Wales, the statutory Forensic Science Regulator Code of Practice version 2 came into force on 2nd October 2025 and sets quality requirements for defined digital-forensic activities. Private commercial work is not automatically the same as criminal-justice casework, but the principles of continuity, validated methods and auditable records remain highly relevant.
What a Good Cyber Investigation Report Looks Like
A report should make the evidence auditable
- state the instruction and scope;
- identify the systems, accounts or data sources reviewed;
- record the time zone used in the chronology;
- distinguish original data from screenshots or exports;
- describe significant gaps or unavailable logs;
- separate fact from inference and attribution assessment;
- identify any third-party evidence that could not be independently verified;
- record preservation or forensic steps where relevant;
- explain alternative explanations for key indicators; and
- avoid claiming certainty that the evidence does not support.
Cybersecurity Improvements Should Follow the Investigation
The purpose of investigation is not only to identify what happened. It should also show which control failed: weak authentication, excessive permissions, poor supplier verification, missing logs, unpatched software, insecure recovery procedures or a process that allowed a fraudulent request to succeed.
For organisations that need wider risk reduction after an incident, our security services can support the broader protective picture alongside specialist cyber providers.
What Private Cyber Investigators Cannot Promise
No legitimate investigator can guarantee the identity of an anonymous user, recover every deleted record, obtain private platform data on demand or trace every attacker to a physical address. VPNs, compromised accounts, overseas infrastructure, deleted logs, carrier-grade networking and provider retention periods can all limit attribution.
A strong investigation explains what is known, what is likely, what remains unproven and which further evidence would require legal or law-enforcement authority.
Different Cyber Cases Need Different Investigation Plans
“Cyber investigation” is a broad label. A compromised Microsoft 365 account, ransomware event, fake social-media profile, website intrusion and online investment fraud may all involve digital evidence, but the evidence sources and urgency are different.
| Incident | First evidence to preserve | Why |
|---|---|---|
| Business email compromise | Original emails, account security logs, mailbox rules, payment chronology | Shows whether an account was compromised or impersonated and how the payment request developed |
| Ransomware | Security alerts, affected-host evidence, ransom note, logs and configuration information | Supports containment, scope assessment and later root-cause analysis |
| Account takeover | Provider alerts, authentication history, recovery changes and known devices | Helps establish when control changed and what the intruder did |
| Online harassment | Original messages, URLs, account IDs, timestamps and context | Content may be deleted or usernames changed |
| Website compromise | Web/server logs, deployment history, changed files and administrator activity | Helps distinguish vulnerable software, stolen credentials and legitimate changes |
| Insider data misuse | Access logs, permissions, file movement and business chronology | Technical events need to be compared with the person's authorised role |
Build a Timeline Before Building a Theory
Cyber incidents generate timestamps from many systems: email, identity provider, endpoint protection, firewall, cloud application, server, payment platform and user reports. Those clocks may use UTC, local time or different formats.
A good investigation normalises time carefully and records the source of each event. When timelines are aligned, apparently unrelated evidence can reveal the sequence: phishing message, credential use, mailbox rule creation, invoice change and payment.
Business Email Compromise Often Leaves Both Human and Technical Evidence
Investigators should not assume that a fraudulent email proves the supplier's account was hacked. The attacker may have registered a lookalike domain, compromised the buyer instead, obtained information from an earlier breach or simply used public knowledge about a real transaction.
The investigation should compare the original message headers, sending infrastructure, account activity, conversation history, invoice formatting and payment change. The commercial team can often explain details that the technical logs cannot.
Preserving Cloud Evidence Requires Fast Action
Cloud platforms may retain security and audit records for limited periods depending on licence, configuration and provider. Some logs are not enabled by default or are available only to administrators. This makes forensic readiness important before an incident occurs.
Businesses should know which logs they have, how long they retain them and who has authority to export them. During an incident, exports should be preserved with enough context to show the source, date and method of collection.
Do Not Let Attribution Distract From Containment
It can be operationally irrelevant in the first hours whether the attacker is an organised criminal group, disgruntled insider or unknown individual. The organisation still needs to stop unauthorised access, protect backups, preserve evidence and decide what systems are safe to trust.
Attribution can continue later when the immediate business risk is controlled.
Online Identity Evidence Needs Corroboration
Usernames, profile photos, IP addresses, domains and cryptocurrency addresses can create useful links, but they can also be reused, spoofed or controlled by multiple people. Investigators should therefore build an identity assessment from several independent indicators.
Link evidence, do not leap from it
One matching username may justify further research. Multiple corroborating identifiers, consistent chronology and independent records can strengthen an attribution assessment. The report should still explain the possibility of account compromise or impersonation where relevant.
Crypto-Related Fraud Still Needs Traditional Evidence
Blockchain transactions can show movement between addresses, but an address is not automatically a named person. Useful investigation may also involve platform records, communications, bank transfers, company identities, domain registrations and witness evidence.
Where funds have moved through regulated providers or crime is suspected, law-enforcement and legal processes may be necessary to identify customers or restrain assets. A private investigator cannot compel those records.
Evidence Handling Should Anticipate Legal Scrutiny
If a cyber dispute may lead to litigation, employment proceedings, insurance claims or criminal reporting, preserve originals where possible and document who obtained each item. Screenshots are useful for volatile online content but should not replace original files or exports when those are available.
Where specialist forensic work is required, avoid experimenting on the original device or account. Actions taken in good faith can still change evidence and complicate later interpretation.
Cyber Incident Reporting Is a Map, Not One Destination
| Organisation | Why it may be relevant | Important point |
|---|---|---|
| NCSC | Technical incident reporting, support and national threat understanding | NCSC reporting does not replace regulatory obligations |
| ICO | Reportable personal-data breach | Risk-based UK GDPR notification can require action within 72 hours |
| Police / fraud reporting service | Suspected criminal conduct or fraud | Emergency or immediate threat situations should use the appropriate police route |
| Sector regulator | Regulated financial, health, infrastructure or other sector | Rules and time limits vary |
| Insurer | Cyber or crime policy notification | Policy conditions may require early notice or approved responders |
| Customers / partners | Contractual, security or high-risk data impact | Legal and communications teams should coordinate accurate messaging |
Preparation Determines How Investigable an Incident Will Be
Organisations that retain useful logs, use unique administrator accounts, maintain asset inventories and keep accurate time have far stronger evidence after an incident. Without that baseline, investigators may be unable to distinguish a malicious action from an authorised one.
Forensic readiness therefore belongs in security planning. The goal is not to collect everything forever; it is to retain the evidence most likely to answer foreseeable incident questions for an appropriate period.
Post-Incident Review Should Produce Specific Changes
“Train staff” is too vague if the incident succeeded because invoice changes were never independently verified. “Improve security” is too vague if the root cause was a shared administrator account without multi-factor authentication.
The investigation should therefore end with control-specific lessons: who verifies payment changes, which logs need longer retention, which accounts need stronger authentication, how leavers are removed, how suppliers report security events and how the response team communicates if normal email is unavailable.
Preserve First, Investigate Methodically, Report to the Right Place
Cyber incidents become harder to investigate as data is overwritten and people act on assumptions. A disciplined response protects the organisation twice: first by containing the immediate problem and second by preserving enough reliable evidence to understand it.
If you need help organising an online fraud, harassment, impersonation or corporate cyber-related enquiry, you can book a confidential consultation with Trojan Investigations. Where specialist incident response or accredited digital forensics is required, we will define the investigative question clearly so the appropriate technical capability can be engaged.
Sources and References
- Office for National Statistics — Crime in England and Wales: year ending March 2026, released 23 July 2026.
- Department for Science, Innovation and Technology and Home Office — Cyber Security Breaches Survey 2025/2026.
- National Cyber Security Centre — What to do when cyber attacks disrupt your organisation, published 28 July 2026.
- National Cyber Security Centre — Incident management guidance and cyber incident response processes.
- National Cyber Security Centre — Cyber Incident Signposting Service / Report a Cyber Incident.
- Information Commissioner's Office — Personal data breaches: a guide.
- Information Commissioner's Office — 72 hours: how to respond to a personal data breach.
- Computer Misuse Act 1990.
- Fraud Act 2006.
- Forensic Science Regulator — Forensic science activities: statutory Code of Practice version 2, effective 2 October 2025.