Service
What happened, with evidence.
Entry point, timeline and the scope of affected data, with a report fit to serve as evidence.
- Disk
- Memory
- Logs
- Timeline
Why it matters
The problem
After an incident two questions remain: how did they get in and what did they touch. The answer must be evidence, not a guess, especially when a regulator, a court or an insurer asks.
Our answer
Digital forensics collects evidence without damaging it, analyses it and turns it into a readable timeline.
What is included
06 modulesDigital forensics
- Disk
- Memory
- Logs
- Timeline
- 01
Disk and memory analysis
Images of affected systems are taken and analysed; the original is never modified.
- 02
Log analysis
Server, network, application and authentication logs are merged into one timeline.
- 03
Malware analysis
What the sample did, where it connected, how it spread.
- 04
Chain of custody
Where, when and by whom every piece of evidence was obtained is documented.
- 05
Expert report
A report fit for a court, a regulator or an insurer.
- 06
Recommendations
The gaps to close so it does not happen again.
How it goes
04 steps
- 01
Preserve evidence
System images are taken, logs collected, the chain documented.
- 02
Analyse
Entry point, sequence of actions and affected data are established.
- 03
Timeline
Events are merged into one table: what, when, where.
- 04
Report
Technical report and management summary; an expert report if needed.
What you get
- 01
Timeline
The attack from start to finish, with evidence.
- 02
Scope of impact
Which systems and what data were affected.
- 03
Expert report
Fit for a third party, with the chain of custody.
Questions
All servicesIs it possible if the incident already happened?
Yes, if logs and images were preserved. If systems were reinstalled, the room for analysis shrinks.
Does the evidence hold in court?
Chain of custody and methods are documented to standards; the report is written as an expert opinion.
How long does it take?
It depends on the number of systems and log volume: a preliminary conclusion in a few days, the full report in one to three weeks.
Can it be done remotely?
Yes, if images and logs are transferred over a secure channel. Some cases require work on site.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start