Security services
Digital forensics
Understand what happened. We investigate available digital evidence to clarify events, possible causes and the impact of an incident.
Discuss your needsThe challenge
When is this useful?
An unexpected change, suspicious activity or incident raises difficult questions. What can the available data show? Which events are connected? Which conclusions can be supported?
We analyse relevant logs and other technical data within the agreed scope. We distinguish established facts from plausible explanations and questions that need more information.
Examples
Typical requests.
- Analyse suspicious logins or changes in available logs.
- Reconstruct the sequence of events around an incident.
- Separate facts, assumptions and missing evidence.
Working transparently
Clarity before we begin.
We agree the questions, systems and available data, plus access and evidence-handling procedures. The completeness and quality of sources affect what we can establish; we explain those limitations.
From question to outcome
How we work.
Define the questions and sources
We discuss context, questions and available information, then agree which data is relevant and how it can be examined.
Analyse the evidence
We investigate the data and connect relevant events. We discuss open questions and additional information that may be needed.
Support the conclusions
We explain what we found, what supports each conclusion and which uncertainties remain, then discuss next steps.
What you receive
What you receive.
- A description of questions, sources and approach
- Relevant findings and connections between events
- A clear distinction between facts and uncertainty
- An explanation of possible impact and further questions
You can ask questions about decisions and results. We explain what is complete, what still needs attention and which next steps may help.
Practical questions
More about digital forensics.
How much does a forensic investigation cost and how long does it take?
The questions, amount of data and quality of sources determine the effort. We agree a defined scope and explain cost and uncertainty in advance.
Can you always establish the full cause?
Possible conclusions depend on the available data and its quality. We make those limits clear and keep open questions open.
Can you also fix issues found during an investigation?
Yes. If the investigation reveals vulnerabilities or improvements, we can agree a separate remediation scope and distinguish it from the investigation.
Direct contact
Tell us what is happening.
You do not need to know the solution yet. Send us a message or email. Prefer to meet first? Request a 30-minute introduction and we will find a time.