DFIR
Digital forensics
Evidence collected and handled so it survives a courtroom, an insurer and a regulator: what was taken, when, by whose hand, and what has to be disclosed to whom.
Chain of custody or it never happened
The difference between an incident report and evidence is process. An image taken with the wrong tool, a disk touched before it was hashed, or a timeline reconstructed from memory will be attacked by the other side and will not support a claim. Our people come from environments where that standard was not optional, and the work is done to it whether or not the case ever reaches a court.
What you get
- Forensically sound acquisition, hashed and documented from the first minute
- Timeline reconstruction across endpoints, servers, cloud and identity logs
- A determination of what data actually left, which decides your notification duty
- Findings written to be understood by lawyers as well as engineers
- Expert testimony where a case requires it
HOW IT WORKS
From first call to steady state
-
Preserve
Before anything else. Every hour a compromised system stays running is evidence overwriting itself.
-
Acquire
Images and volatile memory captured with tooling whose output stands up to challenge, hashed and logged.
-
Analyse
What ran, what connected, what was copied, what was deleted, and in what order.
-
Attribute
As far as the evidence honestly supports and no further. Speculation in a forensic report is a liability.
-
Report
A document that can be handed to counsel, an insurer or a regulator without needing to be rewritten first.
WHAT THIS ANSWERS
The obligations this covers
This is not a marketing claim. Each of these regimes names the requirement that this service is the answer to, and the page behind it says which clause.
Who this is for. Anyone who has had a breach, a departing employee who took something, a fraud, or an insurance claim that has been questioned.
THE REST OF IT
Delivered by the same team
Start with a conversation, not a quote
Tell us what you run and what you are being asked to prove. We will say what this would involve at your size, and whether you need it at all.