Founder who has just found something wrong
Logins appeared from somewhere unexpected, or a customer reported data they should not have been able to see.
Work out what actually happened
After an intrusion we preserve the evidence, reconstruct the timeline, and tell you what was reached and what was not, in language that holds up with regulators.
What arrives
- Forensic images taken and hashed before anything is changed
- A timeline of the intrusion, from first access to discovery
- A statement of what data was reachable, and what was actually accessed
- The entry point identified, with the specific weakness named
Who this is for
Three profiles. If none of them is recognisably you, this is probably the wrong page - and the line below is the one worth reading before you book anything.
Not a fit: Skip this if the systems are still live and spreading, because containment comes first and that is an operations job, not a forensics one.
IT lead after a ransomware or account takeover
Systems are back but nobody can say how the attacker got in, so nobody can say it will not happen again.
Legal or compliance lead facing a disclosure deadline
A regulator or a contract requires notification within days and the facts are not yet established.
What you get
- Forensic images taken and hashed before anything is changed
- A timeline of the intrusion, from first access to discovery
- A statement of what data was reachable, and what was actually accessed
- The entry point identified, with the specific weakness named
- A written report suitable for regulators, insurers and counsel
- A remediation list ordered by what closes the path that was used
What we build it with
- Velociraptor
- Autopsy
- Volatility
- Plaso
- Wireshark
- osquery
- CloudTrail
Chosen per project, not per fashion. If your team already runs something else and it works, we use that.
How the work runs
-
1
1-2 days
Preserve
We capture memory, disk and logs before anyone reboots or cleans up, and hash everything.
From you: Do not wipe or rebuild anything yet, and tell us who has already touched what.
-
2
1-2 weeks
Reconstruct
We correlate the artefacts into a timeline and establish what the attacker could and could not reach.
From you: Access to logs from identity, network and cloud, going back as far as you keep them.
-
3
3-5 days
Report
We write the findings as fact, marking clearly what is proven and what is inference.
From you: Whoever will speak to the regulator, the insurer or your customers.
-
4
1-3 weeks
Close the path
We list what actually has to change, and help your team verify each item is done.
From you: An owner for each remediation item.
How we work together
Fixed project
Scope and price agreed up front. Best when the outcome is known and the deadline is real.
Dedicated team
A named team for a quarter or more. Best when the roadmap will change and you want the context kept.
Staff augmentation
Engineers inside your process and your tools. Best when you have the lead and need the hands.
Invoiced in
- USD
- EUR
- GBP
- CHF
- SGD
- AUD
- CAD
- AED
- SAR
- QAR
- JPY
- INR
Paid by
Card, netbanking, wallet and UPI through Razorpay, which is what our checkout runs on, so anything it accepts we accept. Bank transfer, SEPA, Wise and Payoneer for invoices that prefer it.
NDA before the first call. Full IP assignment on delivery. Contracts under Indian, English or Delaware law.
Work like this
Case studies are being written up
Three are in legal review. We can walk you through the work on a call in the meantime, including the parts that did not go to plan.
What clients say on Google
Live from our Google Business listing - not retyped here.
Loading reviews from Google - read them on Google.
Questions we get asked
Usually not, but it is harder. Rebuilding destroys disk and memory evidence, though logs often survive elsewhere: identity providers, cloud audit trails, network appliances and email gateways all keep their own copies. We work from what remains and are explicit in the report about what could no longer be established.
We can usually tell you what was reachable, and often whether it was accessed. Proving exfiltration needs network or cloud logs from the right window, and many teams do not keep them long enough. Where we cannot prove it either way we say so plainly, because a report that overstates certainty is worse than useless to a regulator.
It is written to. Evidence is hashed at capture, the chain of custody is recorded, and findings separate what is proven from what is inferred. We are not lawyers and we do not advise on liability. Involve your counsel early, and we will work to their instructions on privilege.
Preservation can usually begin the same day, and that is the part where hours matter. Memory is gone at the next reboot and many logs roll within days. Analysis takes one to two weeks depending on how much survives. If you are inside a notification deadline, tell us the date at the first call.
Think something has happened?
Do not rebuild anything yet. Tell us what you have seen and we will say what to preserve first.