Digital Forensics
Acquisition and analysis of digital evidence with chain of custody — to establish what happened, when, and who, with results that hold up in a legal process.
- Who it is for
- Organizations facing internal fraud, intellectual property theft, a contentious employee departure, labor disputes, or an incident that may end up in court.
- Typical duration
- 2 to 8 weeks depending on evidence volume
- Frameworks
- ISO/IEC 27037NIST SP 800-86ACPO
Forensic analysis answers the questions incident response leaves open: not just what happened, but how to prove it to someone who intends to dispute it.
What we work on
- Workstations and servers — Windows, Linux, and macOS: execution artifacts, persistence, file history, and user activity.
- Cloud environments — audit logs, access records, and activity across Microsoft 365, Google Workspace, and the major public clouds.
- Volatile memory (RAM) — running processes, active connections, injected code, and credentials in memory.
- Network traffic — where capture exists, session analysis and transfer reconstruction.
Common cases
The most common is not the sophisticated external attack — it is the departing employee with information. Someone resigns and the organization suspects they took the client book, the source code, or the drawings. Analysis of devices, connected USB media, cloud uploads, and email activity usually answers it precisely, with evidence that supports legal action — provided it is preserved in time.
A warning about time
Digital evidence degrades fast. Logs rotate, free space is overwritten, devices are reassigned to another employee and reimaged. Every day between the event and preservation reduces what can be recovered, and in some cases eliminates it entirely.
If you suspect something that may end in a legal process, preserve first and decide later. Isolating a machine and storing it costs little; recovering what has already been overwritten is generally impossible.
How we run it
- 01
Preservation
Forensic acquisition using write blockers and hash verification. The original is never analyzed — work happens on verified copies.
- 02
Chain of custody
Every transfer, access, and analysis is documented. Without this, technically correct evidence can be ruled inadmissible.
- 03
Analysis
Recovery of deleted files, execution artifacts, connection history, user activity, and evidence of exfiltration.
- 04
Timeline reconstruction
We correlate artifacts across multiple sources to reconstruct the sequence of events with defensible timestamps.
- 05
Report and support
An expert document explaining the methodology in enough detail that another examiner could reproduce the results.
What you receive
- Hash-verified forensic images with full chain of custody documentation
- Expert report with a reconstructed timeline and reproducible methodology
- Conclusions supported to a standard suitable for judicial or administrative use
- Expert testimony and support if the case requires it
- Recommendations for preserving evidence better in future