pls solve within one hour ...only someone experienced in cybersecurity to answer

In a major financial organization, the main web server had been compromised. The incident happened 4 months prior and over the course of a 5 day period, based on the initial findings of the new development firm. No logs were available other than the web server logs for those 5 days. The client needed to know the extent of the damage, and whether they were required to take legal measures such as provide breach notification(s) and report the breach(s) to the attorney general. i) What actions to be taken by the incident response team during the Forensics Analysis? ii) Provide step-by-step analysis and incident documentation. iii) Provide a sample incident template for the case study given