Cyber Forensic Investigation — Intake

Form-DFIR-Intake · Rev 2026.06 · Confidential Web · §

Cyber Forensic
Investigation Intake

Scoping questionnaire for incident response engagement.

If this is an active incident

Do not complete this form first. Call the 24/7 incident hotline, then return to finish the intake while triage begins.

Hotline +1 (000) 000-0000

How to complete

Complete every section marked Critical or Required. Sections marked Reference help us scope the engagement but do not block triage if unknown — leave blank if uncertain.

All information is treated as confidential and, where applicable, is prepared in anticipation of litigation under direction of counsel.

§ 01

Reporter

Required

Full name

Role / title

Organization

Employee headcount

Phone

Preferred contact

Email Phone Either Encrypted channel — please arrange

§ 02

Incident classification

Critical

Suspected incident type check all that apply

Ransomware Business email compromise Unauthorized access Data exfiltration Malware infection Insider threat Denial of service Web defacement Suspected compromise Other

If other, specify

Current confidence level

Confirmed Strong indicators Suspected Investigating possibility

Threat actor or group, if known

Ransom demand received?

Yes No Unknown

If yes amount, currency, deadline, communication channel

§ 03

Timeline

Critical

Date / time first detected

Estimated start or "unknown"

How was the incident detected? alert, user report, third-party notification

Is the activity still ongoing?

Yes No Unknown

§ 04

Affected scope

Critical

Endpoints affected workstations, laptops

1 2–10 11–50 51–250 250+ Unknown

Servers affected

0 1–5 6–20 21–100 100+ Unknown

Cloud / SaaS tenants affected e.g. M365 tenant, AWS prod, Google Workspace

Network segments / sites affected

User accounts compromised est.

Domain controllers or identity providers affected?

Yes No Unknown

§ 05

Data sensitivity & regulatory exposure

Critical

Data types potentially exposed

PII PHI / health records Payment card data Financial records Source code / trade secrets Customer credentials Employee records None apparent Unknown

Estimated record or individual count, if known

Regulatory frameworks in scope

HIPAA PCI-DSS GDPR CCPA / CPRA GLBA SOX FERPA State breach laws Other None

If other, specify

§ 06

Current state

Important

Containment status

Not yet started In progress Believed contained Fully eradicated Unknown

Affected systems isolated from network?

Yes No Partial Unknown

Backups available and verified clean?

Yes No Verifying Unknown

EDR / XDR in environment

SIEM in environment

§ 07

Evidence preservation

Important

Have affected systems been rebuilt, reimaged, or wiped since the incident?

Yes No Unknown

Logs preserved check all sources currently retained

Endpoint / EDR Firewall VPN Cloud audit (CloudTrail, etc.) Email gateway Identity provider DNS Proxy / web filter

Memory captures taken?

Yes No Planned

Forensic disk images captured?

Yes No Planned

Litigation hold issued?

Yes No Not applicable

§ 08

Business impact & urgency

Required

Operational status

Fully operational Partial degradation Critical systems down Full outage

Estimated financial impact to date

Under $10k $10k–$100k $100k–$1M $1M–$10M Over $10M Unknown

Regulatory or contractual notification clocks running jurisdictions, deadlines, started when

Required response window

Under 4 hours Within 24 hours Within 72 hours This week This month

§ 09

Stakeholders & external parties

Reference

Cyber insurance carrier

Claim number, if open

Carrier notified?

Yes No In progress No policy

Breach counsel / outside counsel

Engaged at direction of?

Law enforcement notified

FBI US Secret Service Local police CISA Foreign authority None

Other incident response firms already engaged

Executive awareness

Board notified C-suite aware IT leadership only Limited / need-to-know

§ 10

Engagement preferences

Reference

Preferred deliverable format

Executive briefing Written report Both To be determined

Anything else we should know

This intake is prepared at the direction of counsel and should be treated as attorney work product.

I confirm I am authorized to share this information and to be contacted at the details provided.

Submitting this form opens an intake record in our case management system. A forensic lead will contact you within the response window you selected in § 08.

Submission received

Intake recorded.

A forensic lead will reach out within the response window you selected. If circumstances change before we make contact, call the hotline at the top of this page.

Confidential — prepared in anticipation of litigation § Form-DFIR-Intake / Rev 2026.06

Cyber Forensic Investigation — Intake

Form-DFIR-Intake · Rev 2026.06 · Confidential Web · §

Cyber Forensic
Investigation Intake

Scoping questionnaire for incident response engagement.

If this is an active incident

Do not complete this form first. Call the 24/7 incident hotline, then return to finish the intake while triage begins.

Hotline +1 (000) 000-0000

How to complete

Complete every section marked Critical or Required. Sections marked Reference help us scope the engagement but do not block triage if unknown — leave blank if uncertain.

All information is treated as confidential and, where applicable, is prepared in anticipation of litigation under direction of counsel.

§ 01

Reporter

Required

Full name

Role / title

Organization

Employee headcount

Phone

Preferred contact

Email Phone Either Encrypted channel — please arrange

§ 02

Incident classification

Critical

Suspected incident type check all that apply

Ransomware Business email compromise Unauthorized access Data exfiltration Malware infection Insider threat Denial of service Web defacement Suspected compromise Other

If other, specify

Current confidence level

Confirmed Strong indicators Suspected Investigating possibility

Threat actor or group, if known

Ransom demand received?

Yes No Unknown

If yes amount, currency, deadline, communication channel

§ 03

Timeline

Critical

Date / time first detected

Estimated start or "unknown"

How was the incident detected? alert, user report, third-party notification

Is the activity still ongoing?

Yes No Unknown

§ 04

Affected scope

Critical

Endpoints affected workstations, laptops

1 2–10 11–50 51–250 250+ Unknown

Servers affected

0 1–5 6–20 21–100 100+ Unknown

Cloud / SaaS tenants affected e.g. M365 tenant, AWS prod, Google Workspace

Network segments / sites affected

User accounts compromised est.

Domain controllers or identity providers affected?

Yes No Unknown

§ 05

Data sensitivity & regulatory exposure

Critical

Data types potentially exposed

PII PHI / health records Payment card data Financial records Source code / trade secrets Customer credentials Employee records None apparent Unknown

Estimated record or individual count, if known

Regulatory frameworks in scope

HIPAA PCI-DSS GDPR CCPA / CPRA GLBA SOX FERPA State breach laws Other None

If other, specify

§ 06

Current state

Important

Containment status

Not yet started In progress Believed contained Fully eradicated Unknown

Affected systems isolated from network?

Yes No Partial Unknown

Backups available and verified clean?

Yes No Verifying Unknown

EDR / XDR in environment

SIEM in environment

§ 07

Evidence preservation

Important

Have affected systems been rebuilt, reimaged, or wiped since the incident?

Yes No Unknown

Logs preserved check all sources currently retained

Endpoint / EDR Firewall VPN Cloud audit (CloudTrail, etc.) Email gateway Identity provider DNS Proxy / web filter

Memory captures taken?

Yes No Planned

Forensic disk images captured?

Yes No Planned

Litigation hold issued?

Yes No Not applicable

§ 08

Business impact & urgency

Required

Operational status

Fully operational Partial degradation Critical systems down Full outage

Estimated financial impact to date

Under $10k $10k–$100k $100k–$1M $1M–$10M Over $10M Unknown

Regulatory or contractual notification clocks running jurisdictions, deadlines, started when

Required response window

Under 4 hours Within 24 hours Within 72 hours This week This month

§ 09

Stakeholders & external parties

Reference

Cyber insurance carrier

Claim number, if open

Carrier notified?

Yes No In progress No policy

Breach counsel / outside counsel

Engaged at direction of?

Law enforcement notified

FBI US Secret Service Local police CISA Foreign authority None

Other incident response firms already engaged

Executive awareness

Board notified C-suite aware IT leadership only Limited / need-to-know

§ 10

Engagement preferences

Reference

Preferred deliverable format

Executive briefing Written report Both To be determined

Anything else we should know

This intake is prepared at the direction of counsel and should be treated as attorney work product.

I confirm I am authorized to share this information and to be contacted at the details provided.

Submitting this form opens an intake record in our case management system. A forensic lead will contact you within the response window you selected in § 08.

Submission received

Intake recorded.

A forensic lead will reach out within the response window you selected. If circumstances change before we make contact, call the hotline at the top of this page.

Confidential — prepared in anticipation of litigation § Form-DFIR-Intake / Rev 2026.06

Cyber ForensicInvestigation Intake

Reporter

Incident classification

Timeline

Affected scope

Data sensitivity & regulatory exposure

Current state

Evidence preservation

Business impact & urgency

Stakeholders & external parties

Engagement preferences

Intake recorded.

Cyber ForensicInvestigation Intake

Reporter

Incident classification

Timeline

Affected scope

Data sensitivity & regulatory exposure

Current state

Evidence preservation

Business impact & urgency

Stakeholders & external parties

Engagement preferences

Intake recorded.

Cyber Forensic
Investigation Intake

Cyber Forensic
Investigation Intake