Investigation workbook

Template version: 3.0. Designed for a smaller organization that may outsource IT and monitoring, this workbook assumes neither an internal forensic team nor continuous availability. An internal coordinator owns the case and business decisions. Providers execute and document assigned tasks within their actual access and contractual authority.

How to use this workbook. Sections 1–6 provide the operational sequence. Apply the responsibilities, provenance checks and forms in sections 7–9 before collection and maintain them during investigation. Section 10 is the worked example; section 11 supports handover acceptance. Detailed references apply at the relevant action: their later position does not mean preparation happens after closure.

Type: operational workbook to complete. Copy this document for each incident. It organizes evidence, hypotheses and decisions without replacing your response policy or specialist forensic acquisition. Adapt the bracketed fields before use.

Approval and scope

The incident lead sets priorities. The analyst records observations and limitations. The evidence custodian controls storage and access. Technical owners authorize actions on their systems. The legal or data protection contact determines applicable collection, retention and notification requirements. These responsibilities are proposed assignments: reconcile them with existing delegations and supplier contracts before adoption.

1. Open the case

• ☐ Record the initial report, its author and receipt time with time zone.
• ☐ Describe observed impact separately from potential impact.
• ☐ State the investigation question: account, endpoint, connection or operation to explain.
• ☐ Identify affected services and their owners.
• ☐ Record collection authority and known restrictions.
• ☐ Schedule the next situation update: [TO COMPLETE: time, participants].

Initial summary: “We observe [TO COMPLETE: verifiable fact] within [TO COMPLETE: scope]. We are trying to establish [TO COMPLETE: question]. At this stage, [TO COMPLETE: main uncertainty] remains unknown.” Avoid attributing an action or intention to a person using an IP address alone. Keep a distinction between the affected system, the account used and the person believed to be involved.

2. Maintain the evidence register

Assign a stable identifier to each item. Preserve the original in controlled storage and work on a copy where possible. A file digest helps check that data has not changed; it does not independently establish the truth of the contents or the author's identity. Record the integrity check actually performed, rather than assuming that the collection tool preserved everything.

For every transfer, add sender, recipient, time, purpose and integrity check. Do not put secrets into the workbook: reference their authorized storage instead. Set retention and deletion according to [TO COMPLETE: internal rules, preservation constraints]. Check permissions on shared folders and external responders' access. A reference that the receiving analyst cannot open is a handover problem to resolve, not a completed transfer.

3. Build the timeline

Keep event time, ingestion time and observation time separate. Record the original time zone before normalization. Make every clock correction explicit. A missing log can result from unavailable collection, expiration or a failure. Record which sources were searched and the periods they cover, so another analyst can understand what the search establishes and what it cannot establish.

4. Test hypotheses

Look for an authorized explanation and an independent observation. Distinguish “not found in the sources searched” from “did not happen.” Revise a conclusion when new evidence contradicts it; preserve the previous conclusion and the reason for the change. Timing correlation alone does not establish causation or attribution. Explain a confidence assessment with evidence and limitations rather than an unexplained numerical score.

5. Record decisions and their effects

If urgency requires containment before collection, record what evidence becomes unavailable. For a deferred measure, state the accepted risk, accountable owner and reassessment point. A completed command does not by itself show that the intended effect occurred. Keep the result check linked to the original decision, including an unexpected result or an unsuccessful rollback.

6. Prepare handover and closure

• ☐ Summarize established facts, open hypotheses, impact and uncovered scope.
• ☐ Transfer accessible evidence references and restrictions.
• ☐ List pending actions, owners, due points and escalation criteria.
• ☐ Confirm the coordination channel and next handover.
• ☐ Ask the incoming analyst to restate priorities; record acceptance.
• ☐ At closure, assign residual monitoring, corrections and follow-up ownership.
• ☐ Check retention, restrictions and authorized deletion of temporary copies.

Limitations: this workbook does not guarantee that evidence will be legally admissible. Investigations involving people, sensitive information or critical systems require appropriate authority. Notification deadlines depend on applicable obligations; have competent advisers determine them. Do not insert a deadline copied from a different jurisdiction without checking that it applies.

Put the workbook into service

Before first use, the template owner checks that responders can access evidence storage, find a source event and use the handover channel. A completed field without a verifiable reference does not turn a hypothesis into a fact. If a source is missing, record who can supply it, what period remains recoverable and which decision is blocked. Set follow-up objectives locally according to urgency and available resources.

Before distribution, the incident lead checks that each important conclusion links to evidence or is explicitly a hypothesis. Prepare a restricted summary when recipients do not need personal or technical details. Corrections retain the previous version reference, author and reason. Handover acceptance transfers responsibility for agreed actions; it does not remove documented uncertainty.

7. Make the case usable in an outsourced environment

For an organization of approximately 80 staff, appoint an internal person who can reach business owners, authorize agreed expenditure and obtain interruption decisions. IT may collect records while an MSSP analyzes its alerts. Neither provider should be assumed to control every SaaS record. Establish who can export data and confirm an action for each service.

Before collection, record assets, identities, SaaS services, remote work, supplier access, investigation period and exclusions. Include data location, export capabilities, contractual restrictions and the owner authorizing access. Personal equipment and industrial systems require specific decisions; this workbook grants no authority to intervene in them. Mark an unavailable capability explicitly rather than allocating it to an uncontacted provider.

If a contact is unavailable, use the backup and contractual escalation route. Record attempts, time, impact and the next decision point. A request sent to a provider remains requested, not completed. Meanwhile, an internal decision maker may restrict activity through available authorized means or explicitly accept a documented temporary risk. They must not assume administrative access that nobody has verified.

8. Control provenance, quality and clocks

For each export, record the interface or query, time parameters, selected time zone, filtering and pagination. Check that the exported period matches the request. Record license restrictions, sampling or truncation. If a provider supplies only a screenshot, state what it establishes and request source events where the reasoning needs them. Preserve the provider's explanation of any unavailable fields.

Distinguish native records, documented exports, indirect observations and reported information. This is a proposed working classification, not a universal legal evidence scale. A useful statement can guide a search without proving a sign-in. A detection tool may normalize a value; preserve its source link before interpreting that field. Explain the transformations used, including changes introduced during subsequent analysis.

Do not force precise ordering when clock accuracy or offset prevents it. Describe a time window and preserve both possibilities. NIST SP 800-86 discusses system clock and time-zone differences; justify any working margin through local observations rather than a universal numerical tolerance. The timeline must allow a later reviewer to distinguish a measured offset from an analyst's assumption.

A digest calculated after receipt checks stability of the received copy; it does not establish that the provider exported the complete source. Ask how collection was performed and preserve the answer. Any useful conversion produces an identifiable working copy; do not silently replace the original. Retain superseded files with the reason for correction and the link to their replacement.

9. Additional forms to copy

An exception records the unmet requirement, reason, risk and compensating controls actually available. The business owner or designated authority accepts or rejects it; an analyst must not turn missing proof into approval. After adoption, this model requires expiry and an early reassessment trigger, using a locally chosen period. Expiry requires another decision rather than silent renewal.

10. Complete worked example — entirely fictional

Fictional company Workshop-80 has 80 staff and provider-administered SaaS email. At 08:20 UTC, finance reports an unrecognized forwarding rule. The internal coordinator opens INC-EX-01. IT collects records because the MSSP can access alerts only. Every person, account and action in this example is fictional; none describes an actual customer or incident.

Fictional management accepts temporary account restriction despite delayed order processing. Decision EX-D1 identifies the delegated coordinator, provider execution, verified rule removal and open session check. An authorized business change remains possible until approval history is checked. The interim conclusion is a disputed operation, not an identified human perpetrator. The case records the operational impact alongside the protection decision.

At the fictional 09:30 UTC handover, the incoming analyst locates EX-E1, restates both unknowns and accepts three tasks: check sessions, establish affected messages and seek business authorization. The coordinator retains decision ownership. The case cannot close merely because the rule disappeared; residual actions need owners and the conclusion must stay within the evidence actually available.

11. Check completeness and accept handover

• ☐ An internal owner and deputy are reachable independently of the suspect account.
• ☐ Every major conclusion has evidence, a limitation or explicit hypothesis status.
• ☐ Authorized responders can reproduce queries and periods searched.
• ☐ Transfers and corrections preserve provenance and versions.
• ☐ Requested, executed and verified actions are distinct.
• ☐ Decisions under uncertainty identify authority, risk, compensation and reassessment.
• ☐ The incoming responder confirms evidence access, priorities, contacts and next decisions.
• ☐ Temporary copies and provider access have removal conditions.

Closure is separate from handover. It states covered scope, facts, accepted unknowns, business consequences and actions tracked elsewhere. The owner approves distribution and storage; competent functions determine applicable retention and obligations. A later review should be able to understand why a decision was reasonable using information available at that time, without treating an interim judgement as final certainty.

Working references

NIST SP 800-61 revision 3 places incident response within risk management. NIST SP 800-86, published in 2006, provides a forensic collection and analysis framework; its technical examples need current review. These tables and procedures are editorial proposals to adapt, without certification or compliance guarantees.