attacker investigation