Overview
US insurers, outside counsel and regulators expect defensible evidence after an incident, and many investigations run at counsel's direction. We preserve evidence with documented chain of custody, reconstruct what happened and assess which records may have been accessed, so decisions under state breach laws, HIPAA or the FTC Safeguards Rule rest on facts rather than guesses.
After a security incident, leadership, insurers, regulators and sometimes courts need clear answers: How did attackers get in? What did they access? Is the threat gone? Digital forensics provides those answers through careful, evidence-based investigation.
Our analysts collect and preserve evidence from endpoints, servers, memory, cloud platforms, email systems and logs using forensically sound methods and documented chain of custody. We reconstruct attacker timelines, determine root cause and data impact, and analyze malware samples to understand capabilities, persistence and indicators of compromise.
Forensic investigations are available as part of active incident response or as standalone investigations, such as insider threat or suspected data theft.
Incident response for US organizations
- Facts gathered quickly for SEC, NYDFS, FTC Safeguards Rule and state breach notification decisions
- We work alongside your insurer's panel firms and outside counsel where a policy or legal strategy requires it
- Evidence preserved with chain of custody for insurers, counsel and law enforcement referrals
- Clear executive summaries for boards, customers and regulators, written in plain English
What's included
Our approach
- ScopeDefine questions, systems and legal considerations.
- PreserveCollect evidence forensically with chain of custody.
- AnalyzeTimeline reconstruction and malware analysis.
- ConcludeRoot cause, scope and data impact.
- ReportClear reports for each audience.
What you receive
- Chain-of-custody documentation
- Attack timeline
- Malware analysis report and IOCs
- Data impact assessment
- Executive and technical reports
Standards & frameworks
- NIST SP 800-86
- ISO/IEC 27037
- ISO/IEC 27035
- MITRE ATT&CK
- SEC Form 8-K Item 1.05
Frequently asked questions
Should we turn off infected computers?
Avoid powering off systems before speaking with responders — volatile memory can contain critical evidence. Isolate them from the network instead.
Can your reports be used in legal proceedings?
We follow forensically sound practices and document chain of custody; work with your legal counsel on specific requirements.
Do you analyze malware samples we send you?
Yes. Submit samples through a secure channel agreed with our team.
Can you help us meet breach notification deadlines?
We help you establish the facts regulators and counsel need: what happened, which data and how many people were affected, and what you have done in response. That supports decisions under state breach laws, the FTC Safeguards Rule's 30-day notice, NYDFS 72-hour reporting and SEC Form 8-K. The decision to notify, and the notification itself, stay with you and your counsel.
Can you support US organizations from India?
Yes. All services are delivered remotely by our team in India. India is 9.5 hours ahead of US Eastern time during US daylight saving time (10.5 hours in winter) and 12.5 to 13.5 hours ahead of Pacific time. Meetings and testing windows are agreed around your US time zone at scoping, and 24/7 services run around the clock.