SOC & INCIDENT RESPONSE · PROFESSIONAL SERVICES
Evidence that holds up when it is questioned
A standalone forensic investigation — of a compromised system, an insider matter, a data-theft allegation, or a second look at an incident already closed. Chain-of-custody imaging, timeline reconstruction, malware and artefact analysis mapped to MITRE ATT&CK, and a formal report that is defensible to regulators, insurers, law enforcement and internal accountability.
ENGAGEMENT AT A GLANCE
SourcesSystems, endpoints and network infrastructure
HandlingDocumented chain of custody
OutputFormal forensic report with exhibits
YOU RECEIVE
Forensic imaging under documented chain of custody
Disk, memory, log and network artefact analysis
Malware analysis and MITRE ATT&CK mapping
Reconstructed timeline of user and system activity
Formal forensic report written for legal and regulatory scrutiny
WHAT'S COVERED
Scope of the engagement
01
Imaging & chain of custody
Forensically sound images of the systems in question, hashed and recorded, with every transfer and examination documented — an unbroken record is what makes the findings usable.
02
Disk analysis
File systems, deleted data and artefacts of execution — the traces left by what somebody did, rather than what they later said they did.
03
Memory analysis
Volatile evidence — running processes, injected code, credentials and live connections — captured while the system is still up.
04
Malware & artefact analysis
What the tooling left behind does, how it got there and what it reached — ransomware and web-shell cases included.
05
Log & network correlation
Authentication records, endpoint telemetry and firewall and network logs correlated into a single defensible timeline.
06
ATT&CK mapping & reporting
Techniques mapped to MITRE ATT&CK, findings stated with the artefacts behind them, and the limits of the evidence stated just as plainly.
COMMON QUESTIONS
Before you ask
How is this different from incident response?
Incident response is engaged while something is happening, and containment comes first. This is the investigation on its own — a compromised system, an insider matter, a dispute, or a review of an incident that has already been closed.
Can you examine a device without taking it away?
Often, yes. Imaging can be performed on site and the analysis carried out on the image afterwards, which usually matters when the device belongs to someone who still needs to work.
What if the evidence does not show what we expected?
Then that is what the report says. Findings are stated with the artefacts behind them and the limits of the evidence stated as clearly as the conclusions — a report that overreaches does not survive being questioned.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the findings would survive being challenged.
REPORT CONTENTS
Statement of the questions the investigation was asked to answer
Acquisition record with device details and hashes
Reconstructed timeline of user and system activity
Findings, each tied to the artefacts that support it and mapped to MITRE ATT&CK
Exhibit list, and an explicit statement of the evidence’s limits
WHAT WE NEED FROM YOU
The questions you need answered, and by when
Physical or remote access to the devices in scope
Any legal or HR constraints on handling and disclosure
A single instructing contact, for privilege and chain of custody
FRAMEWORKS THIS EVIDENCES
ISO/IEC 27037ISO/IEC 27042NIST SP 800-86MITRE ATT&CK
Acquisition and analysis follow these so the findings are defensible to a regulator, an insurer or a court rather than only internally persuasive.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.