In the event a security compromise results from the potential actions of a third party, it will likely become necessary to engage the assistance of forensic experts in marshalling and dealing with electronic evidence in the context of litigation. Be cautious of engaging a forensics company without identifying the specific expert who will be working on your project. Internal experts are, however, extremely useful as adjuncts to the third party expert. They have in-depth knowledge of their employers systems and procedures, which can be invaluable.”]
Source: https://www.csoonline.com/article/2136610/expert-assistance-in-investigating-data-breaches.html