01Practice
Incident response and digital forensics (DFIR) services
Practitioner-led incident response and digital forensics: containment, evidence-sound investigation, malware analysis and root cause, plus the readiness work that makes a serious incident manageable. Response readiness is available 24×7.
- Name
- Incident Response & Digital Forensics
- Line
- 01 · Cybersecurity
- Type
- Practice, engaged on its own or within a program
01The problem
Incidents are decided in the first hours.
The difference between a contained incident and a company-wide crisis is usually preparation and the first few decisions: what to isolate, what to preserve, who to inform and what to say. Teams without a rehearsed plan destroy evidence, alert the attacker and make disclosure decisions blind.
Incident response and forensics combine two disciplines: responding fast enough to limit damage, and investigating carefully enough that your answers to the board, regulators, insurers and customers hold up.
- Evidence-sound from the start
- Collection and analysis follow forensic standards, so findings survive scrutiny from regulators, insurers and courts if it comes to that.
- Root cause as well as recovery
- Wiping and reimaging without understanding the intrusion invites reinfection. We establish how access was gained and whether it persists.
- Readiness changes outcomes
- IR plans, playbooks and tabletop exercises prepared before an incident mean the first hours go to containment, not to working out who decides what.
02Scope
What incident response covers.
Incident Response
Rapid engagement to scope, contain and eradicate active intrusions: ransomware, business email compromise, insider events.
Digital Forensics
Forensically sound acquisition and analysis of disks, memory and logs with maintained chain of custody.
Endpoint Investigation
Deep analysis of compromised hosts: persistence mechanisms, execution artifacts and attacker tooling.
Memory Forensics
Volatile-memory analysis to uncover in-memory malware, injected code and credentials in use.
Cloud Forensics
Investigation across AWS, Azure and Microsoft 365: audit log reconstruction, token abuse and OAuth persistence.
Email Investigation
Business email compromise investigation: mailbox rules, delegation abuse, mail-flow tracing and financial-fraud timelines.
Malware Analysis
Static and dynamic analysis to determine capability, communication and impact of malicious code.
Threat Hunting
Post-incident and proactive hunts to determine whether attacker access persists elsewhere in the estate.
Compromise Assessment
A structured answer to "are we breached right now?", based on an evidence review of endpoints, identity and logs.
Root Cause Analysis
Reconstruction of the intrusion timeline: initial access, movement, actions on objective and control failures.
Evidence Collection
Defensible acquisition and preservation for legal, regulatory and insurance processes.
IR Readiness & Post-Incident Review
IR plans, playbooks, tabletop exercises and honest post-incident reviews that produce fixes, not blame.
03Approach
How an incident response engagement runs.
Engage & scope
An immediate triage call: what is known, what is at risk, what must be preserved. First response actions are agreed on that call.
Contain
Isolate affected systems and cut attacker access without destroying evidence or alerting an active adversary prematurely.
Investigate
Forensic acquisition and analysis across endpoints, identity, email and cloud to reconstruct the full intrusion timeline.
Eradicate & recover
Remove persistence, close the initial access vector and support safe restoration of services.
Report & harden
A defensible incident report covering timeline, impact and root cause, plus a prioritized hardening plan. Our IT operations and cloud teams can carry out the rebuild and hardening work.
04Deliverables
Incident response deliverables.
- Incident timeline with evidence references
- Scope-of-compromise and data-impact assessment
- Root cause analysis and control-failure findings
- Forensic images and preserved evidence with chain of custody
- Executive and regulator-ready reporting
- Post-incident hardening roadmap
When this work fits
- Organizations currently experiencing or suspecting an incident
- Companies that suffered ransomware, BEC or data theft
- Teams needing an IR plan, playbooks and tabletop exercises before an incident
- Boards and insurers requiring an independent compromise assessment
05Questions
Incident response: questions we are asked
Contact us immediately: use the incident line on our contact page. Do not power off affected machines, do not wipe anything, and limit discussion on channels the attacker might read. We will triage the situation on the first call.
Yes. Evidence handling and reporting are built to support insurance claims, legal privilege workflows and regulatory notification requirements, for example under GDPR, HIPAA, NIS2, DORA, CERT-In directions and the DPDP Act.
Yes. An IR retainer gives you pre-agreed terms, an onboarded environment and named escalation contacts. The paperwork is done before the incident, when hours matter. See incident response readiness.
Cloud and SaaS intrusions are a core part of the practice: token theft, OAuth abuse, mailbox compromise. We investigate cloud-native evidence sources directly.
Digital forensics and incident response. Incident response is the work of containing an attack and restoring operations. Digital forensics is the evidence-sound investigation that establishes what happened: how the attacker got in, what they touched and whether data left. The two run together, because containment decisions made without forensic findings often miss a second foothold.
Do not wipe or rebuild affected systems, and do not power them off, because memory evidence is lost. Isolate them from the network instead. Do not reset every password at once before the scope is known, and avoid discussing the incident on systems the attacker may be reading. Record what was seen and when, and preserve logs before retention removes them.
A timeline of attacker activity with supporting evidence, the initial access route, affected systems, accounts and data, and the actions taken to contain and remove the intruder. It states what could not be determined and why. Recommendations are ordered by how directly they would have prevented or shortened the incident. A separate summary is written for leadership, insurers and regulators.
Most delay in an incident comes from missing logs, unclear authority and contacts nobody can find. Readiness work fixes those in advance: log retention, an incident plan with named decision-makers, playbooks for likely scenarios and a tabletop exercise that tests them. Our incident response retainer and readiness program covers this.
Often alongside