Digital and Cyber Forensics

Stop changing the affected systems, and do not wipe or reimage them. The instinct after a breach is to rebuild the host and get back to work, but a reimage destroys the evidence that would have told you how far the intruder reached and what they took. Isolate the machine at the network rather than powering it off, because memory holds running processes, connections and credentials that disappear on shutdown. Keep other people from logging in to look around, since each session writes new artefacts over older ones, and write down who noticed what and when while it is still fresh. Extend or freeze log retention on identity, endpoint and firewall systems before the window rolls, and check whether your backups are on a delete schedule. Then call us: our first phase is engagement and preservation, and it begins by telling your team what to leave alone. Evidence that is gone does not come back.

Chain of custody means each item of evidence is logged with the time, the place and the person who handled it, and that log is a named deliverable, the Chain of Custody Record. Disks are imaged through a verified write blocker so the source is not altered, images are hashed and verified against the source, and cloud and mobile data is collected through documented exports rather than screenshots. It matters because the first question from anyone contesting your findings is whether the evidence could have changed between the incident and the report. A hash that still matches, alongside an unbroken handling log, answers that without argument. The handling is measured against published standards including ISO 27037 and NIST SP 800-86, and against the ACPO and SWGDE guidance. If the matter later reaches counsel, an insurer or a tribunal, that record is what makes the rest of the report usable.

Deleted files are often recoverable; overwritten ones generally are not. On a system reached early, file system artefacts, memory and correlated logs together usually show what ran, what left the network and how the intruder held on. What defeats recovery is time and overwriting: a disk that kept running for weeks, a log that aged out of its retention window, a cloud service that keeps only thirty days of sign-in records, or a device reimaged before anyone called. Encrypted volumes without keys, and remote systems you do not control, sit outside reach. Attribution to a named human is usually beyond what technical evidence alone can carry; it can place an account and a device at an action. Our reconstruction phase states plainly what the evidence cannot answer, rather than filling gaps with plausible narrative. A report that separates proven fact from inference is the one that survives a hostile reading.

They are written to be read by all three. The forensic report ties conclusions back to the underlying artefact, so a reader can follow a statement to the log line, file or memory structure it rests on, and technical and legal readers are served by the same document. The incident timeline sets out the entry point, the dwell time and what data was accessed, copied or destroyed, which is the substance an insurer or counsel works from. We brief your counsel, insurer and leadership directly, and provide expert testimony if the matter proceeds. On the regulatory side, CERT-In directions require certain incidents to be reported within six hours of noticing them, and the DPDP Act carries its own breach notification duties. Those obligations sit with you and your counsel. Forensics supplies the facts a notification has to rest on; the filing and the legal judgement are not ours to make.

It starts with a scoping call. You tell us about the environment, the systems involved and any deadlines you are working to, and we come back with scope, effort and a start date. In an active incident we agree the preservation steps on that call, so evidence is protected while the paperwork is settled, along with legal privilege and who the findings are reported to. You supply access to the affected systems and the relevant logs and exports, and the sooner those are made available the more of them still exist. Not included: we do not give legal advice, we do not make regulatory filings for you, and rebuilding or hardening the environment afterwards is separate work, though the report tells you what needs attention. Analysis is done by hand, and findings are reproduced before they are written down. SecureRoot is ISO/IEC 27001:2022 certified, certificate IN60432E, and ISO 9001:2015 certified.