The necessary ones make the site work. The others measure which pages help and which ads bring the people who need DM11. Your choice, and you can revisit it from the footer.
Proposal
We preserve the evidence, rebuild the timeline and tell you what actually happened, whether on a seized device or in system logs. If the result is going to end up in court, the chain of custody has to hold from the very first touch, which is why the worst decision in a suspected case is letting the IT team poke around before calling anyone.
No price appears on this page. Scope does: what we do, how we run it, who runs it and what is not included. The people who read your request are the ones who will look after you, and they come back with the proposal and with time to talk it through.
What happened, how they got in and what they took.
We preserve the evidence, reconstruct the timeline, and state what actually happened, whether on a seized device or in system records. If the outcome may end up in court, the chain of custody must be intact from the very first touch. That is why the worst decision when facing a suspicion is letting the IT team dig in before calling someone.
What we examine depends on the case. For files and records, we analyze access, application, network, and email logs together with the files involved, to establish misuse, information theft, or intrusion. For devices and computers, the copy is made bit by bit, the original is preserved intact, and custody is documented, so the analysis cannot be challenged later.
The depth matches what is at stake. Analyzing what is visible resolves most internal inquiries. Going further, into system artifacts, execution traces, and correlation across sources, supports a disciplinary decision or a conversation with the regulator. The advanced level recovers what was deleted, detects attempts to hide tracks, and produces the expert forensic report.
We need access to the material to examine and formal authorization from its owner. You receive the hour-by-hour timeline and the technical report; for device examinations, the documented chain of custody; and, at the advanced level, the signed expert forensic report, in a format accepted in court.
Evidence preservation
We copy and seal before any analysis. The original stays intact and custody is documented from the first touch.
Analysis
We rebuild what happened from the traces, cross-checking different sources until the timeline holds together.
Report
We consolidate the findings into a report where every item comes with severity, evidence and the path to fix it. We write to be read by the people who will act, not to fatten pages.
Usually comes together with
Not a bundle, and it changes nothing you have already chosen. It is what tends to come up next, in the experience of companies that have been through this.