Digital forensics
Digital evidence is fragile and easy to spoil. Everything we do is designed so that an independent examiner, given the same material, would reach the same conclusions by the same route.
What the engagement covers
- 01Forensic imaging with write protection
- 02Computer, mobile and server examination
- 03Log and network evidence analysis
- 04Timeline reconstruction
- 05Expert reporting and testimony support
Findings that hold up when someone sets out to challenge them.
Six steps, in this order, every time.
No step is skipped because a case is urgent. Order is what makes the finding defensible.
- Step 01
Identification
Establish which systems, devices and accounts hold relevant data, and secure them before anything changes.
- Step 02
Preservation
Isolate the sources and record the chain of custody from the first moment a device is handled.
- Step 03
Acquisition
Create verified forensic images with write protection, and confirm integrity by hash before examination begins.
- Step 04
Examination
Work only on copies. Recover artefacts, deleted material and activity traces using documented methods.
- Step 05
Analysis
Correlate the artefacts into a timeline and separate what the evidence shows from what it merely suggests.
- Step 06
Reporting
Present findings, method and limitations in language a non-technical decision maker can act on and a specialist can audit.
- Work on copies
- Original media is preserved untouched. Every examination happens against a verified image.
- Document everything
- Each action is recorded with time, operator and method, so the work can be repeated independently.
- Prove integrity
- Hash verification before and after handling shows the evidence did not change in our custody.
- State the limits
- Where the evidence cannot support a conclusion, the report says so plainly.
Scope first, quotation second.
Tell us what the estate looks like and what concerns you about it. We will say plainly whether this engagement is the right one.
Contact Cyber Keen