Reinstalling or formatting
Starting a system “from scratch” overwrites the logs, files and traces that documented the incident.
Resources · Digital evidence
Digital evidence: why you must not delete anything after an incident.
Reinstalling, deleting, “starting from scratch”: the most natural reflexes are often the ones that destroy what could have protected you. Digital evidence is fragile and volatile: once overwritten, it does not come back.
The right reflex: don’t touch anything else, have the situation assessed.
Evidence status
Preserved · timestamped · intact
Logs
Logins collected
Headers
Original emails
Screenshots
Dated, unaltered
Usable file
Bank · insurer · courts →
01 · WHAT DESTROYS EVIDENCE
Well-meant moves that make a case indefensible
After an incident, you want to make the problem go away as fast as possible. But reinstalling, deleting or “cleaning up” erases essential traces: dates, addresses, logins, histories. Done in good faith, these actions sometimes make a case indefensible.
Deleting messages & logs
Emails, text messages, login logs: once erased, they do not come back, and they are often what proves the facts.
Continuing to use a compromised account
Every new login covers the attacker’s tracks and muddies the timeline of the intrusion.
“Cleaning up” the device
Aggressive antivirus scans, emptying the recycle bin, restoring factory settings: all actions that remove evidence before it has been collected.
02 · WHAT CAN SERVE AS EVIDENCE
What keeps its weight over time, if it is properly preserved
Some material, collected and preserved correctly, keeps its value in front of a third party. The collection method matters as much as the content: a file moved carelessly loses its weight.
Logs & logins
Login logs, addresses, dates and times: the framework that reconstructs who did what, and when.
Headers & original messages
Email headers and unaltered messages: they reveal the real origin and the route of a fraudulent message.
Timestamped screenshots & statements
Dated screenshots and transaction statements: datable items that support a dispute or a complaint.
03 · THE PRESERVATION CHAIN
Preserve, then assess: what to do
The rule is simple. Before any repair, we secure what can still be secured, to build a case file that holds up.
01IdentifyPinpoint the accounts, devices and messages affected by the incident.
02IsolateSet aside what is compromised, without formatting or reusing it.
03CollectGather logs, headers, screenshots and statements properly.
04TraceRecord who collected what, when and how: traceability documents every step.
05PreserveKeep the material in a way that it remains usable as evidence over time.
06Hand overDeliver a clear file that the bank, the insurer or the courts can use.
04 · A CASE FILE THAT HOLDS UP
What well-preserved evidence actually does for you
In the processes that matter, the strength of the file often determines the outcome. A documented, intact file carries weight with a third party, even though no result is ever guaranteed.
What a solid file makes possible
The processes where evidence makes the difference
- Disputing a bank transaction and supporting a refund claim.
- Triggering insurance cover after a cyber incident.
- Filing a complaint with datable, consistent documents.
- Supporting a civil or business dispute with a third party.
We never promise a guaranteed result: we build a file so that it holds up, and we explain every step to you.
Depending on your situation
The right contact, down to the evidence
- Individual: bank fraud, compromised account, identity theft: help starts with Galyct Perso.
- Business: intrusion, ransomware, data leak: incident handling and the evidence register with Galyct Pro.
- Sensitive case: when evidence is decisive, the firm steps in directly, with strict confidentiality.
Is an incident in progress?
Don’t face it alone. Don’t delete anything, don’t reinstall anything, don’t pay anything. Badly preserved evidence is worthless. Describe the situation to us: we secure what can still be secured and make the first decisions with you.
Don’t touch anything else.
The first step is not to repair: it is to preserve. What is overwritten does not come back, but what is preserved can defend you.
Evidence to secure? Let’s talk.
A first conversation with an expert about your situation, no commitment, no sales pitch. An individual? Help starts free of charge, straight away.