Assessments
Digital Forensics
Digital forensics and incident response (DFIR) with a documented chain of custody, evidence acquisition, timeline reconstruction and a certified report suitable for legal, insurance and compliance use.
Scope
- Evidence acquisition and preservation with a documented chain of custody
- Disk, memory and log analysis across affected systems
- Timeline reconstruction: initial access, movement, actions taken
- Root-cause analysis of the entry path and scope of exposure
- Indicators of compromise for your monitoring going forward
Method
Forensically sound handling from the first touch: originals are imaged and hashed before analysis, every step is logged, and findings are tied to verifiable artefacts rather than speculation.
Deliverable
A certified forensic report suitable for legal, insurance and compliance proceedings, with a plain-language account of what happened and concrete steps to close the entry path.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- Is your report admissible for legal or insurance use?
- Yes, we handle evidence forensically from first contact, with a documented chain of custody, and produce a certified report suitable for legal, insurance and compliance proceedings.
- What if we think we are under attack right now?
- Say so in the first line of your message so we can prioritise. We focus on preserving evidence, understanding the entry path and giving you concrete steps to close it.
- What do you need from us to start?
- Access to the affected systems and logs under written authorisation. Originals are imaged and hashed before analysis, so nothing is altered.
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.