Digital forensics & investigation

Build an account supported by evidence.

Specialist delivery and availability are confirmed during scoping.

THE RIGHT STARTING POINT

For suspected compromise, internal investigations, or incident follow-up. Specialist acquisition, litigation support, and expert testimony require separately verified qualifications and scope.

A clear scope. A useful outcome.

Agree the investigative questions, relevant systems, and legal or employment constraints before collecting information. Preserve evidence with documented handling and distinguish observed facts from hypotheses. Coordinate findings with the incident owner and counsel where required so decisions reflect the strength and limits of the available evidence.

The final scope, deliverables, and timing are agreed for your engagement.

What we cover

• Evidence availability and preservation planning
• Authorized endpoint, identity, and cloud evidence collection
• Event timelines and activity correlation
• Impact analysis and investigation reporting

What you take away

• Collection scope and evidence handling record
• Timeline with evidence references and confidence notes
• Technical findings and unanswered questions
• Preservation and follow-up recommendations

How to engage

A defined investigation or readiness exercise; activation and availability must be agreed.

What progress looks like

Investigative questions resolved with traceable evidence and uncertainty clearly documented.

Before the engagement.

Agree the systems and business processes in scope, the authorisation required, the people involved and how the findings will be used. Timelines, deliverables, exclusions and any verification work should be confirmed directly.