Suspect ransomware, unauthorized access or a data leak? NALVRA helps assess the situation, coordinate immediate measures and investigate the technical causes.
View initial stepsWe assess affected systems and impact, coordinate isolation of suspicious devices and access, and prioritize next steps with your IT team. Operations are restored in a controlled manner after reviewing the affected environment.
We examine storage media for relevant digital traces. This includes coordinated acquisition, analysis of suitable working copies and transparent documentation of findings, timelines and investigation limits.
Authorization, media handover and scope are agreed before work begins. Originals and transfers are documented; admissibility in court is not guaranteed.
For retired devices, returns or reuse, we erase storage media using a method suited to the media and protection requirements. After successful completion and verification, we issue a traceable erasure and verification record.
The record documents the media identifier, method, date and verification result. Media that cannot be successfully erased or verified are identified accordingly and discussed with you separately.
Notify internal IT and security staff through a trusted channel. Assign a point of contact and agree on a communication channel.
Coordinate with IT to isolate suspicious devices from the network where safe. For production or safety systems, involve the responsible operators first.
Do not rush to restart, reset or clean up systems. Record times, visible messages and actions already taken. Coordinate further changes with those responsible.
Protect backups from being overwritten. Reconnect affected systems only after technical review; plan recovery and further measures together.
