If you suspect your computer has been hacked, you shouldn't hastily delete programs, install security software, reset the system, or reinstall Windows or macOS. While such measures might be useful for later cleanup, they can also alter or destroy digital traces that could be crucial for reconstructing a potential attack.

First, a distinction must be made between suspicion and an actually verifiable security incident. A slow computer, high processor usage, unusual fan noises, or isolated error messages do not prove a hacking attack. Unknown user accounts, unauthorized logins, unexplained remote maintenance software, altered security settings, or unusual network activity, on the other hand, may warrant a more thorough investigation.

If there is a concrete suspicion, two goals must be weighed against each other: limiting further damage and preserving existing digital traces as much as possible. Which measure takes precedence depends on whether the attack is possibly still ongoing, sensitive data is affected, access data has been stolen, or the computer is to be forensically examined later.

What should I do immediately if my computer may have been hacked?

First, document as precisely as possible what you have noticed. Note the date and approximate time, any unusual messages, suspicious programs, unknown logins, or other changes.

If possible, photograph or document any unusual screen activity. Do not hastily delete suspicious emails, files, or programs if the incident is to be investigated later.

For a computer used for business purposes, you should also inform the responsible IT or security department and not make extensive changes to the system on your own.

Should I immediately disconnect a potentially hacked computer from the internet?

In the event of a suspected ongoing attack, disconnecting the network connection can help to interrupt further communication with external systems and limit additional data leakage.

However, for a forensic investigation, an active network connection can simultaneously provide valuable information. Active connections, processes, and data in memory can contain clues to an ongoing attack.

Therefore, there is no one-size-fits-all solution. Network isolation may be appropriate for a private computer with an acute security risk. In the case of a serious corporate incident, the decision should ideally be made by IT security or forensic experts.

Should I turn off the computer immediately?

Not automatically.

When the computer is shut down, volatile information is lost from memory. This can include running processes, active network connections, decrypted content, and other information that may be relevant in a forensic investigation.

On the other hand, a compromised system that continues to operate can cause additional changes.

In the event of a serious incident where evidence is needed, a decision should therefore be made, if possible before switching off the power, as to whether volatile data needs to be saved.

Why can RAM be important in a hacker attack?

The memory of a running computer can contain information that is no longer available after it is switched off.

This can include running processes, network connections, loaded modules, and other volatile system information.

In certain attacks, RAM backup can therefore be an important component of forensic evidence preservation.

Should I restart my computer?

In cases where evidence is potentially needed, this should preferably not be done without prior consideration.

A restart terminates processes, clears volatile memory information, and simultaneously generates new system events.

This can change the original situation.

Should I run an antivirus program?

If the sole aim is to clean up the system as quickly as possible, security software can be useful.

The situation is different in a planned forensic investigation. A virus scanner can delete, modify, or quarantine files, thereby altering the original evidence.

Therefore, before any automatic cleanup, a decision should be made as to whether a forensic backup is necessary first.

Should I uninstall suspicious programs?

Not if the incident is to be investigated.

A suspicious application can itself be an important object of investigation. Uninstalling it can modify or remove program files, configurations, logs, and other artifacts.

Should I delete suspicious files?

Not even if there is a legitimate interest in obtaining evidence.

A suspicious file may contain information about its origin, file type, hash value, or other technical characteristics.

It should be examined carefully and not simply opened or deleted.

Should I reinstall Windows or macOS?

Not before a planned forensic investigation.

A new installation changes large areas of the data carrier and can overwrite existing traces.

If it is necessary to first determine whether and how the computer has been compromised, evidence should be secured before a new installation.

Should I reset the computer to factory settings?

Even a reset can change or remove significant amounts of data.

For simply restoring a secure system, this might be an option later. However, for reconstructing a potential attack, a reset before securing evidence is problematic.

Should I change my passwords?

If access data may have been compromised, important passwords should be changed.

If possible, use a different trusted device for this. If the suspect computer is indeed compromised, new login credentials should not be entered unnecessarily on that specific system.

Which passwords should I change first?

The central email account often takes priority because passwords for other services can be reset through it.

Depending on the situation, Microsoft, Google or Apple accounts, business user accounts, cloud services, banking and payment services should then be checked.

If the same password was used for multiple services, these accounts must also be taken into account.

Should I enable two-factor authentication?

Yes, provided the respective service supports suitable two-factor authentication.

It significantly hinders access with a stolen password. However, it does not replace checking whether unauthorized sessions or other access methods already exist.

How can I tell if my computer has been hacked?

There is no single characteristic that reliably proves a hacking attack.

Suspicious signs could include unknown user accounts, unexplained administrator rights, foreign remote maintenance programs, unusual autostart entries, disabled security features, unknown browser extensions, or unexplained logins.

However, each of these findings must be classified from a technical perspective.

Is a slow computer a sign of a hacking attack?

Not alone.

A computer can become slow due to software updates, insufficient free memory, background processes, hardware problems, or numerous other causes.

Low performance is therefore not reliable evidence of a compromise.

Is high CPU usage suspicious?

It can be grounds for an investigation, but it has numerous harmless causes.

Browsers, updates, synchronization services, video editing, and other programs can generate high processor load.

The crucial factor is which process is causing the high capacity and whether there are any other anomalies.

Is high network traffic an indication of a hacker attack?

Unusual data traffic can be security-relevant, but it does not necessarily indicate an attack.

Cloud synchronization, backups, updates, and streaming can transfer large amounts of data.

For a reliable evaluation, target systems, processes, timing, and other network data must be taken into account.

What do unknown user accounts mean?

A truly unknown user account with extended rights may be relevant.

However, operating systems and installed software can also create technical service accounts.

Therefore, it should first be determined when and how the account in question was created.

What does an unknown administrator mean?

An inexplicable account with administrator rights deserves special attention.

The mere designation as an administrator does not, however, prove an attack. The decisive factors are the time of origin, usage, and other system traces.

What does "unknown remote maintenance software" mean?

Remote desktop and remote maintenance programs basically allow a computer to be operated remotely.

Such software is used both legitimately and abusively.

If a remote maintenance application is present without any apparent reason, it should be investigated when it was installed, what its configuration is, and whether any signs of use can be detected.

Can someone control my computer remotely?

Yes, if the necessary technical requirements are met.

This can include legitimate remote maintenance software, compromised user accounts, malware, or exploited security vulnerabilities.

Which possibility exists in a specific case can only be assessed based on the available evidence.

Can someone secretly turn on my webcam?

Software with the appropriate permissions can generally access a webcam.

Whether such access actually occurred cannot be deduced solely from assumptions.

Depending on the system, processes, applications, and other artifacts can be examined.

Is it possible for someone to secretly use my microphone?

Microphone access is also technically possible if an application has the appropriate rights or if security mechanisms have been overcome.

However, concrete proof requires technical evidence.

Can a hacker see my files?

If an attacker has gained sufficient access rights to the system, files can also be affected.

The actual scope depends on the user or system access achieved and on existing encryption mechanisms.

Is it possible to determine if files have been opened?

Under certain conditions, operating system, file system, and application artifacts can provide clues about the use of specific files.

However, complete documentation is not possible for every file and every system.

Is it possible to determine if files have been copied?

In some cases, file system traces, USB artifacts, cloud activity, application data, or other information can provide clues to a possible copying operation.

A single finding should not be overinterpreted.

Is it possible to determine if data has been copied to a USB stick?

An operating system can store information about connected USB devices.

However, proof that a particular USB stick was connected does not in itself prove a file transfer.

Additional file, time, and storage medium information may be required to technically support a potential copying operation.

Is it possible to determine whether data has been uploaded to a cloud?

Depending on the cloud service and available data, local synchronization artifacts, browser data, logs, or cloud activity information may be relevant.

In complex cases, the relevant cloud environment can therefore be examined in addition to the computer.

Is it possible to determine if someone has read my emails?

In the case of a compromised email account, login and session information can provide important clues.

Forwarding rules or changed account settings can also be relevant.

Therefore, the investigation should not be limited exclusively to the computer if account misuse is possible.

Can a hacking attack only affect my user account?

Yes.

Not every supposedly hacked computer is actually compromised at the operating system level.

Sometimes only login credentials for email, Microsoft 365, Google, cloud services or other online accounts were stolen.

Device compromise and account compromise must therefore be investigated separately.

How can I identify unauthorized registrations?

Many online services provide information about active sessions, logged-in devices, or current security events.

Unknown entries should be documented.

However, an unusual location or an unknown IP address does not automatically prove an attack, as VPN, mobile network or dynamic IP addresses, for example, can influence the display.

Can an IP address identify the hacker?

Not automatically.

An IP address can initially only describe a technical connection at a specific point in time.

VPN services, proxy servers, compromised systems, corporate networks and other technical factors can significantly complicate the attribution.

What is malware

Malware is a collective term for harmful software.

This includes, for example, Trojans, spyware, ransomware and other programs that can perform unwanted or harmful functions.

What is a Trojan?

A Trojan is a type of malware that often disguises itself as a legitimate file or application, or is executed alongside seemingly legitimate content.

The specific functions can vary greatly.

What is spyware on a computer?

Spyware attempts to gather information about the system or the user.

Depending on the malware, files, browser information, input, or other data may be affected.

What is a keylogger?

A keylogger records keystrokes.

It can be implemented as software or, in certain cases, as hardware.

Software keyloggers can be used, for example, to steal login credentials.

What is ransomware?

Ransomware is malicious software that locks or encrypts data or systems and is often associated with a ransom demand.

In the event of a ransomware incident, work on the affected systems should not continue in an uncoordinated manner, as in addition to recovery, root cause analysis and possible data leaks may also be relevant.

What is an information stealer?

Infostealers are malicious programs that can specifically collect information from a system.

Depending on the malware, this can include, for example, browser data, saved login data, cookies, or other information.

Why are stolen browser sessions problematic?

An attacker does not need the actual password in every scenario.

Certain session information may be misused to take over already authenticated accounts.

Therefore, changing a password alone may not be sufficient in the case of certain attacks.

What is a backdoor?

A backdoor refers to a hidden or unintended access point to a system.

Attackers may attempt to establish such access points in order to be able to access a compromised system again at a later date.

What does persistence mean?

Persistence describes mechanisms by which malware or an attacker attempts to maintain access even after a restart or logout.

This can involve the misuse of, for example, autostart mechanisms, services, scheduled tasks, or other system functions.

What does malware forensics investigate?

Malware forensics examines suspicious files, programs, and system artifacts for evidence of malware and its possible activities.

The goal is not just to find a suspicious file, but to understand its technical relationship to the affected system.

What does IT forensics investigate in cases of suspected hacking?

Depending on the question, data carriers, file systems, user accounts, system logs, browser data, programs, autostart mechanisms, USB artifacts, network traces and other digital information can be examined.

IT forensics is not intended to confirm an existing suspicion at all costs. Its purpose is to determine, based on available technical data, which processes are actually traceable.

How does a forensic examination of a computer proceed?

First, the state of the system is documented and the specific research question is defined.

Depending on the incident, it may be necessary to back up volatile data. Subsequently, the relevant data carrier or data set is backed up in a controlled manner, if possible.

The actual analysis is then performed on the backed-up data and not by arbitrarily searching the original system.

Why is a forensic copy created?

Forensic preservation allows for the analysis of a defined data set without unnecessarily altering the original evidence through subsequent examination.

Depending on the data carrier and method, significantly more information can be captured than with a normal file copy.

What is the significance of hash values?

Cryptographic hash values ​​can be used to verify the integrity of a secured data set.

This allows for later verification of whether the examined fuse has changed compared to the documented reference state.

What is the Chain of Custody?

The Chain of Custody describes the traceable chain of evidence.

For example, it documents when a computer or data carrier was acquired, backed up and examined, and who handled it.

This traceability is particularly important in investigations relevant to evidence.

What digital traces can reveal a hacking attack?

Depending on the attack, relevant factors may include unusual login events, suspicious processes, new user accounts, autostart entries, unknown programs, changed system configurations, network connections, or suspicious files.

A reliable finding often only emerges from the combination of several independent traces.

Why is a single suspicious find often not enough?

Many technical artifacts can have both legitimate and abusive causes.

Remote maintenance software may, for example, have been installed by the user, set up by the IT service provider, or misused by an attacker.

Only installation, configuration, usage times and other system traces allow for a more reliable classification.

What does correlation mean in the context of a hacker attack?

Correlation means comparing different digital traces with each other in terms of time and technology.

A suspicious login might, for example, coincide with downloading a file, running a program, and then connecting to a network.

Several matching artifacts can support a possible sequence of events much better than a single find.

Can it be determined when the computer was hacked?

Under favorable conditions, the possible timeframe for a compromise can be narrowed down.

For this purpose, file, log, user, program and network events, for example, can be compared.

However, an exact time cannot be determined in every case.

Can it be determined how the attacker gained access to the computer?

Partially.

Possible entry points include phishing, compromised login credentials, malware, remote maintenance programs, or exploited security vulnerabilities.

Whether the original attack path can still be reconstructed depends on the data obtained.

Can it be determined what the hacker did?

Under certain conditions, user, file, program, and network activities can be reconstructed.

However, a complete and uninterrupted record of all actions does not usually exist.

Therefore, the study can only make statements that are supported by the available data.

Can it be determined which data was stolen?

This is one of the most challenging questions to answer in a security incident.

Clues can arise, for example, from file activity, archives, cloud services, USB usage, or network data.

However, a complete record of every transmitted byte is not possible with every system.

Is it possible to determine if a USB stick was used?

Under certain conditions, operating systems store information about connected USB devices.

These may contain manufacturer, product or series information and timing details.

However, the mere connection of a data storage device does not prove data leakage.

Can it be determined whether the attacker deleted any files?

Depending on the file system and existing artifacts, there may be indications of deleted files or previous file existences.

However, attributing a deletion to a specific person or action requires additional information.

Can deleted files be recovered?

Yes, under certain conditions.

Whether recovery is possible depends, among other things, on the storage medium, file system, encryption, TRIM functions and any interim usage.

Therefore, a complete restoration cannot be guaranteed in general.

Why is an SSD particularly problematic when data is deleted?

Modern SSDs use features such as TRIM and internal memory management.

This allows deleted storage areas to be handled differently from a technical perspective compared to traditional magnetic hard drives.

The traditional notion that every deleted file can be easily reconstructed from free storage space is therefore no longer up-to-date.

Can a hacker erase their traces?

Attackers may attempt to remove files, logs, or other traces.

However, this does not necessarily mean that all evidence disappears. Other data sources may still contain information about certain processes.

What does a negative forensic finding mean?

A negative finding means that no reliable evidence of the issue in question was found within the examined data set.

It does not automatically prove that no attack took place at an earlier time.

Why can a hacking attack be more difficult to prove later?

Computers continuously change their data during normal operation.

Logs are overwritten, temporary files are removed, software is updated, and free memory areas are reused.

The longer ago an incident occurred and the more intensively the system continues to be used, the more the evidence can change.

What information should I keep for an investigation?

Save any suspicious emails, messages, files, and existing security alerts.

Note any anomalies with date and time and document any unknown logins or devices.

In the event of a corporate incident, firewall, VPN, server, cloud and other central logs may also be relevant.

Why can cloud logs be important?

Many activities today do not take place exclusively on the local computer.

Microsoft 365, Google Workspace, cloud storage, and other services may have their own login and activity information.

This data can complement a local investigation.

Why can firewall and VPN logs be important?

They may contain additional information about network connections and remote access.

Especially in corporate incidents, the combination of end device and central network data can be crucial.

How quickly should a hacked computer be investigated?

If there is a specific need for proof, please contact us as soon as possible.

This does not mean that data is automatically deleted every minute. However, continued use does continuously change the data.

In the event of an ongoing attack, rapid damage control may also be necessary.

What is particularly important in a company computer?

A compromised work computer can be part of a larger security incident.

It should therefore be checked whether other systems, user accounts, servers, cloud services or network components could be affected.

Focusing solely on the visible workstation computer may be insufficient in the case of a complex attack.

What are the most critical aspects of administrator accounts?

Administrator accounts have extensive rights.

If the corresponding access data has been compromised, an attacker may be able to access further systems or data.

Such incidents should therefore be contained with particular care.

What should be considered in the event of a potential data breach?

First, it should be clarified which data was technically accessible and which specific traces indicate a transfer.

The fact that an attacker theoretically had access to a file does not automatically prove that it was actually transferred.

This distinction is essential when assessing a potential data leak.

When should an expert be consulted?

In complex or disputed technical matters, an expert investigation can be useful, especially if the results later need to be presented in a comprehensible manner to companies, insurance companies, lawyers or courts.

For relevant technical questions, an expert office for IT and mobile forensics can be consulted.

Can IT forensics identify the perpetrator?

Not automatically.

IT forensics can investigate technical relationships, user accounts, devices, connections, and other digital traces.

The unambiguous attribution of a technical action to a specific natural person may require additional investigations.

Can IT forensics prove that my computer has been hacked?

If suitable technical evidence is available, an investigation can provide conclusive proof of a compromise or significantly support a corresponding suspicion.

In other cases, the result may only be a narrowing down or a negative finding.

A serious investigation therefore does not promise a predetermined result.

Can IT forensics also determine that no hacking attack has occurred?

An investigation must be conducted without prejudice to the outcome.

Technical anomalies can also be explained by legitimate software, misconfigurations, user actions, or hardware problems.

Therefore, a suspicion should neither be automatically confirmed nor dismissed without investigation.

Practical example: Unknown remote maintenance software

A user discovers a remote maintenance application on his computer that he is not familiar with.

The mere discovery does not, in itself, prove a hacking attack.

The investigation therefore examines when the software was installed, what configuration is present, and whether other system artifacts provide evidence of actual use.

Only this additional information allows for a more reliable assessment.

Practical example: Suspicious email attachment

An employee opens an unknown attachment and shortly afterwards notices unusual activity on his computer.

For an investigation, the original email, the attachment, system events, processes, files, and network traces may be relevant.

If the system is immediately reinstalled, parts of this evidence may be lost.

Practical example: Unknown login to a Microsoft account

A user discovers an unfamiliar login and therefore suspects a hacked computer.

The investigation may show that not the computer itself, but only the online account was compromised.

This example shows why device and account compromise must be distinguished from one another.

Practical example: Suspected data theft

A company suspects that confidential files have been leaked from a work computer.

A forensic investigation can, for example, compare file accesses, connected USB devices, cloud applications, and other relevant artifacts.

Only the correlation of multiple data sources can enable a more reliable technical reconstruction.

FAQ: Computer hacked – what to do?

What should I do first if I think my computer has been hacked?

Document any specific irregularities and avoid unnecessary changes. In the event of an immediate attack, measures to mitigate damage must be examined simultaneously.

Should I turn off the hacked computer immediately?

Not automatically. When the computer is switched off, volatile information is lost from the RAM, which may be relevant for an investigation.

Should I disconnect the computer from the internet?

Network isolation can be useful during an ongoing attack. In complex or evidentiary incidents, this measure should be implemented in a controlled manner.

Should I restart my computer?

If there is a legitimate interest in obtaining evidence, this should preferably not be done without prior consideration, because this could result in the loss of volatile data.

Should I run a virus scan immediately?

Not necessarily before a planned forensic backup. A virus scanner can modify, delete, or quarantine files.

Should I delete suspicious programs?

Not if the incident is to be investigated later. The program and its data may contain important clues.

Should I reinstall Windows?

Not before a planned evidence preservation. A new installation may overwrite relevant data.

Should I change my passwords?

If compromised login data is suspected, yes, preferably via another trusted device.

Which password should I change first?

The central email account should often be prioritized because it can be used for password resets of other services.

Is a slow computer proof of a hacking attack?

No. A slow computer can have numerous other causes.

Is high CPU usage a sign of malware?

Not necessarily. What matters is which process is causing the high workload and what other anomalies are present.

Can someone control my computer remotely?

Yes, if appropriate remote access software, compromised accounts, malware or other technical access possibilities exist.

Can someone turn on my webcam?

Software with sufficient permissions can generally access a webcam. Whether this actually happened needs to be investigated in each specific case.

Can someone listen in on my microphone?

Such software access is technically possible. However, concrete surveillance cannot be inferred from this without leaving further traces.

Can it be determined when my computer was hacked?

Under favorable conditions, the time period can be narrowed down using various digital artifacts.

Can it be determined how the hacker gained access?

In some cases, phishing, malware, remote access, or compromised login credentials can be reconstructed as possible entry points.

Is it possible to determine which files the hacker viewed?

Under certain conditions, file system and application artifacts can provide clues about used files.

Can it be determined which data was stolen?

Sometimes data leaks can be technically substantiated or limited. However, complete proof of all transferred data is not always possible.

Is it possible to determine if a USB stick was used?

Yes, under certain conditions. However, simply connecting a USB stick does not, in itself, prove a file transfer.

Can a hacker erase their traces?

Attackers can remove traces. Other data sources may still contain clues about the incident.

Can IT forensics identify a hacker?

Not automatically. Technical traces can be examined, but a definitive attribution to a natural person may require further investigation.

How quickly should the computer be examined?

If there is a specific need for evidence, this should be done as soon as possible, as normal further use can alter existing digital traces.

Can I continue using the computer until the examination?

If there is a serious interest in obtaining evidence, unnecessary further use should be avoided as far as possible.

What is more important: stopping the attack or securing evidence?

That depends on the specific risk. In the case of ongoing, significant damage, damage control takes priority. If the attack has already ended and later reconstruction is necessary, preserving evidence may be given greater weight.

Can a computer be hacked even if no virus is found?

Yes. An incident could involve, for example, compromised user accounts, legitimate remote maintenance software, or other attack methods that are not necessarily recognized as a classic virus.

Could my account be hacked even though my computer is clean?

Yes. Account compromise and device compromise are two different things.

What does it mean if the forensic investigation finds nothing?

This initially means that no reliable evidence of the alleged incident was found within the examined dataset. However, this does not completely rule out the possibility of a previous attack in every case.

When is a professional IT forensic investigation advisable?

A professional investigation can be particularly useful in cases of specific technical anomalies, potential data leaks, financial damage, compromised company systems, or later evidentiary needs.

In case of suspected hacking, don't delete first, but understand the incident.

The most important question is not just: "Has my computer been hacked?", but first and foremost: "What concrete indications are there and what actually happened?"

A slow computer, high processor usage, or an unusual program are not sufficient for conclusive proof. Likewise, it would be wrong to rule out an attack simply because a virus scanner doesn't detect any malware.

A security incident can affect the computer itself, a user account, a cloud service, or multiple systems simultaneously. Therefore, it is essential to first determine which level might be affected.

In the event of an immediate attack, limiting further damage is paramount. However, if there is a significant interest in providing evidence, it should be considered that switching off, restarting, deleting, virus scans, and reinstalling the system can alter its original state.

A forensic investigation therefore does not merely attempt to find malware. It reconstructs, based on available data, which activities are technically verifiable, when they might have taken place, and what conclusions the existing traces actually allow.

Especially in cases of potential data leaks, compromised business systems, or legally relevant incidents, this separation between suspicion, technical findings, and professional assessment is crucial.

Back to knowledge overview