Services

Digital Forensics

Digital forensics is the work of figuring out exactly what happened after something's already gone wrong — a breach, suspected insider activity, or a legal matter that hinges on what a device or system actually shows. It's detailed, evidentiary work, and it has to be done in a way that holds up to scrutiny, not just a quick look to satisfy curiosity.

The core discipline is preserving evidence before anything else touches it. The moment a system is examined carelessly, you risk altering timestamps, overwriting logs, or otherwise destroying the thing you're trying to investigate. That's why the first move is always proper imaging and chain-of-custody documentation — not opening files and poking around.

What this typically covers

Reconstructing a timeline of what happened on a compromised system: when access occurred, what was accessed or exfiltrated, and how the intrusion actually happened. For insider incident investigations, it's about establishing what actually occurred, defensibly, rather than relying on assumptions or office rumor. For legal matters, the output has to be something that can actually be presented and stand up — documented methodology, preserved chain of custody, and findings that are reproducible by someone else looking at the same evidence.

Working alongside incident response

Forensics and incident response are related but distinct — IR is about containing and recovering quickly; forensics is about understanding exactly what happened, which sometimes means slowing down in places IR wants to move fast. I coordinate both so you get the speed you need without destroying the evidence you'll want later, whether that's for your own post-incident review, an insurance claim, or litigation.

If you're dealing with a suspected incident or need a defensible investigation into what actually happened, reach out — the sooner evidence is preserved, the more there is to work with.