Incident investigation — DFIR
We investigate an incident’s entry point, progression and scope through digital evidence, then help determine containment and recovery actions.
01 / ASSESSMENT
DFIR combines digital forensics and incident response. Preserve evidence integrity while examining logs, disk images or memory captures. Reconstruct the timeline, identify affected assets and investigate entry causes; coordinate containment and recovery with the responsible team.
PRACTICAL SCENARIOS / TTP
TTPs are an adversary’s tactics, techniques and procedures. We analyse these approaches and select scenarios for your environment and the scope agreed in writing, connecting each assessment result to practical defensive guidance.
Use Velociraptor or agreed acquisition tools to collect logs, execution traces and filesystem history. Preserve copy integrity and correlate timestamps across devices to reconstruct who acted, when and which systems were affected.
Examine suspicious processes, memory captures and connections; analyse files in isolation. A single indicator is not a verdict. Correlate program behaviour, persistence evidence and communication endpoints before drawing conclusions.
Define affected identities and devices, the observation period and visibility gaps. Tie credential rotation, rebuilds and backup restoration to evidence. Deliver return-to-service criteria and controls for detecting recurrence.
02 / OUTCOMES
Work proceeds under the system owner’s written authorisation, a contract and a confidentiality agreement. Assets, methods, timing, stop conditions and data handling are defined before work begins.
Send your requirements through CyberTrust. We will clarify asset count, assessment depth and expected outcomes with you, then set out timing and pricing in the proposal.