Chasing the DFIR Cure, pt II

Following my first post on this topic, an interesting comment was shared that I thought would really benefit the discussion, as well as benefit from a further look.

To paraphrase, the comment was along the lines of,"...how do you justify the additional cost of a second (or third) look when the results are coming out the same?"

In my experience, that hasn't been an issue.

First, when someone has decided that additional eyes on the data is a justified step to take, the value is already understood, and the cost-benefit analysis has already been done.  Take the pro bono case I mentioned in my previous post; in that case, the value was understood prior to the attorney contacting me, and the decision was made after contact and initial discussions/scoping to do the work pro bono.

Second, while I have been aware of and party to "second looks", in my experience, the results are rarely the same as the "first look". The comment above assumes that the results would be the same, but I simply haven't found that to be the case. 

I did some pro bono work (different case from the one previously mentioned) involving someone leaving a firm, and "salting the earth" on their way out.  What I mean by this is that someone submitted their letter of resignation, and after they left the building, it was found that their system was infected with ransomware.  In this case, the system they were assigned was "communal", in that there was a critical application installed on the system, with just one license, so the CEO needed to have access to it at all times.  My analysis was actually the third look, and I was able to demonstrate that the evening prior to the "incident", someone had logged in at 9pm and browsed the web for about 6 minutes.  During that time, the system became infected, and a persistence mechanism was established, which led to the ransomware launching when the user (not the CEO) logged in the next morning and wrote out their letter of resignation.  The case was thrown out, and a counter suit for libel went forward, based on my report.

This is just one example, but the findings were different enough from the law enforcement officer's report and another consultant's report that the outcome was significantly impacted, and the direction of the case altered.