Cybersecurity
Digital forensics and incident response
When something has gone wrong, you need facts: how they got in, what they touched, whether they are still there, and how to remove them. We investigate carefully and keep evidence usable.
What the first hours decide
The choices made early in an incident affect what can be learned later. Rebooting a machine can erase memory evidence. Wiping and restoring can destroy the entry point. Resetting a single account while the attacker holds others only warns them.
We help you stabilize while keeping evidence, then build a picture of what happened from endpoints, identity logs, cloud audit trails and network records. We aim to answer scope questions that legal, insurance and leadership will ask.
What is in scope
-
Triage and scoping
Establish what is known, what systems are involved and what needs preserving now.
-
Evidence collection
Disk and memory images, logs, cloud audit records and email data, with documented handling.
-
Endpoint forensics
Windows, Linux and macOS artifacts: execution, persistence, credential access, lateral movement.
-
Identity and cloud forensics
Microsoft 365, Entra ID, AWS, Azure and Google Cloud audit logs.
-
Malware and tooling analysis
Triage of attacker tools to understand capability and indicators.
-
Containment and eradication advice
Coordinated steps to remove attacker access without alerting them prematurely.
-
Recovery support
Guidance on rebuilding, credential resets, restoring from backup and hardening before reconnect.
-
Reporting
Timeline, root cause, scope, and recommendations; facts only, no legal conclusions.
How the work runs
Stabilize
Stop the bleeding and preserve evidence.
-
1
Intake
Collect initial facts and agree on roles and communication.
-
2
Preservation
Capture volatile data and logs at risk of rotation.
Investigate
Reconstruct what happened.
-
3
Analysis
Build the timeline from endpoint, identity, network and cloud data.
-
4
Scoping
Identify affected accounts, systems and data.
-
5
Interim reporting
Brief your team regularly with what is known and what is not.
Recover and learn
Close the intrusion.
-
6
Eradication and recovery
Plan and support removal of access and safe return to service.
-
7
Final report
Findings, timeline and improvements.
What you receive
- Interim updates during the response
- Incident timeline
- Root cause and scope statement
- Indicators of compromise for your tools
- Evidence log and chain of custody records
- Recovery and hardening recommendations
- Final report
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Who can make decisions during the incident
- Contacts for counsel, insurer and communications
- Access to logs and systems
- A list of actions taken so far
What this service is not
- Legal advice or breach notification decisions
- Negotiation with attackers
- A guarantee of full recovery
What changes afterwards
- Leadership has facts for decisions about notification and recovery
- The attacker’s access is removed with confidence
- The entry point is closed
Questions people ask
Can you start remotely?
Often yes, using collection tools run by your administrators on our instructions. On-site help depends on location and is discussed during intake.
Do you work with our cyber insurer or counsel?
Yes, when you ask us to. Many policies and legal strategies shape how engagements are structured, so tell us at intake.
Should we turn off affected machines?
Isolate from the network if you can do so safely. Do not shut down or wipe until you have spoken to someone, because memory evidence is lost on power-off.
Related
-
Compromise assessments
A focused, time-boxed look for signs that attackers are or have been in your environment.
-
Ransomware readiness
Assess whether you could detect, contain and recover from ransomware, and fix the weak points: identity, backups, segmentation and response.
-
Incident response planning
Write plans and playbooks your team can use at 2 a.m., based on NIST SP 800-61 Rev 3 and tested against realistic scenarios.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response