System and method for identifying cybersecurity threats

A computer-implemented system for automatic collection, analysis and reporting of a cybersecurity event, the system comprising:

• a memory;
• and a computer processor that is programmed to:
• provide a first graphical user interface portion designed to receive a selection of one or more types of forensic artifacts to collect from one or more data source designations, wherein the one or more data source designations correspond to data sources including forensic artifacts that can be searched and collected;
• configure a standalone executable computer program to collect forensic artifacts indicating removal of data by a departing employee on a remote client system computer based on the selection of a plurality of types of forensic artifacts to collect and the one or more data source designations, the types of forensic artifacts comprising electronic records of recently accessed files, printing history, deletion of a file, editing of a file, downloading a file into a removable storage, installed applications, internet history, sending an email, sending a text message, and capturing an image;
• execute the standalone executable computer program on a volume shadow copy of the remote client system computer to (1) automatically collect the forensic artifacts based on the selection of the plurality of types of forensic artifacts and the one or more data source designations with the interface, wherein collecting the forensic artifacts comprises obtaining the forensic artifacts from archived data corresponding to system data from a date earlier than a date of an execution of the executable computer program, (2) store the collected forensic artifacts in a temporary data storage, and (3) encrypt the collected forensic artifacts into an encrypted data package;
• receivem at an investigator/consultant's operation center, the encrypted data package from the standalone executable computer program, wherein the encrypted data package includes the forensic artifacts automatically collected by the executable computer program;
• decrypt, at the investigator/consultant's operation center, the encrypted data package to produce decrypted forensic artifacts;
• automatically analyzing the decrypted forensic artifacts using a forensic toolset based on one or more analytic routines and one or more analysis queries, wherein the forensic toolset comprises a set of forensic tools that output analysis results;
• presenting through a second graphical user interface portion an option to select a plurality of types of output reports, wherein the plurality of types of output reports comprise an output report customized for a plurality of different types of forensic investigations including departing employee investigations and an output report customized for the technical proficiency of a given plurality of different readers within a target audience comprising both a consultant and a client of the consultant;
• receive a selection of the one or more types of output reports;
• responsive to the selection, automatically generating the one or more types of output reports;
• and
• communicate the one or more types of output reports.