The situation
A tool report is not a reconstruction of events. Digital traces need to be interpreted in context and compared with the wider matter.
Service
Reconstruct activity.Understand the event.
We help establish what happened on a device or account, when and in what sequence. We examine available digital material in misconduct, information leak and incident matters, explaining the basis and limits of each finding.
When to involve us
- A computer, phone, user account or set of logs needs examination.
- The start, extent or sequence of an incident is unclear.
- Data may have been removed, concealed or altered.
- Digital material needs to support a wider investigation.
What we examine
The scope follows the question and the material available.
- Storage media, forensic images and traces of activity
- System logs, timestamps and their consistency
- Accounts, permissions and traces of identity use
- Access, actions, effects and possible attempts to remove traces
- The basis and limits for distinguishing error, misuse and deliberate activity
How we work
Preserve
We preserve material to limit modification and maintain a traceable account of the work.
Examine artefacts
We assess relevant traces from devices, files, accounts, browsers, email and logs.
Build the chronology
We compare timestamps and events. Gaps may reflect missing data, retention, acquisition limits or an absence of activity; each needs assessment.
Compare findings
We test tool output against the rest of the material. The analyst interprets the results.
What you receive
A reconstruction of digital activity or an incident with confidence levels and limitations. Other parts of the matter may require non-digital sources.
Account activity alone does not establish the identity, intent or motivation of a person. A missing log or artefact must be assessed in the context of retention and the other data.
We agree the form of the deliverable and the scope of recommendations before work begins. The outcome includes limitations and questions that remain unresolved.
The experience behind the work
- Digital material preservation and analysis
- Activity reconstruction
- Incident analysis
- Assessment of artefact significance and limitations