What happened, in what order, through which account, and what left the building. Evidence acquired under write-block, hashed at the point of capture, and written up for someone who intends to argue with it.
By the time we are called, someone has usually rebooted the server to see if that fixes it, run a cleanup tool across the endpoint, reset the compromised account's password, and let the firewall logs roll past their retention window. Each of those is a reasonable instinct. Together they remove the running processes, the network connections, the unlinked files still held open, the attacker's session token and the record of when it was issued.
Volatile data goes first and does not come back. RAM dies with the power. A cloud audit trail on a ninety-day default silently drops the week you needed. If you do one thing before we arrive, do nothing: a machine isolated at the switch and left powered on is worth more than a machine that has been helpfully cleaned.
An investigation with no custody record is an opinion with timestamps in it. The hashes are what make it evidence.
Full physical memory capture while the host is still running: process list, loaded modules, open handles, network connections, injected code, and credentials held only in RAM. Pull the plug first and this entire category is gone.
Bit-for-bit images to E01 or raw, taken through a hardware write blocker or a verified read-only mount, so the source device is provably unchanged. Nothing is examined on the original.
Microsoft 365 Unified Audit Log, Entra ID sign-in records, AWS CloudTrail and S3 access logs, Google Workspace admin events. Several of these default to 90 days or less, and some tenants retain far less than that. Preservation is day-one work, not week-three work.
Logical and file-system extraction from iOS and Android where the device and the authorization allow it. What is reachable depends on model, OS version and lock state, and we tell you which before we start, not after.
Firewall and proxy logs, NetFlow, DNS query records, VPN session tables and mail gateway trails. These usually answer the question your executives actually care about: what volume of data left, and to where.
Four hundred endpoints cannot all be imaged. We collect a targeted artifact set per host, identify the machines that matter, and image those in full. The report states which hosts received which depth of treatment.
SHA-256 computed as the image is written, recorded on the acquisition form with device serial, operator and time zone.
The hash is recomputed when the image reaches the analysis environment. A mismatch stops the work and is reported, not quietly re-imaged.
Who held which item, from when until when, and why. Each transfer is signed by both sides. The log is an annex to the report, not an internal file.
Analysis runs against a working copy in a controlled store. The master image is not mounted, parsed or carved.
At the end of the matter the evidence is returned or destroyed on your written instruction, and you get a certificate saying which, for which items.
If you or your counsel hand us material you acquired yourselves, we will examine it, and the report will state plainly that custody before our involvement cannot be attested by us. That sentence protects you more than its absence would.
How access was first obtained: a phished credential used without MFA, an exposed service, a vendor account, a stolen session cookie replayed from a different ASN. Where the evidence will not carry a single answer, the report says so and lists the candidates.
Scheduled tasks, run keys, services, WMI event subscriptions, new local accounts, SSH keys appended to authorized_keys, OAuth application consents, mailbox forwarding rules that nobody notices for months.
Which account reached which host, over which protocol, at which minute. Logon types, remote service creation, admin share writes and credential reuse across machines, mapped against MITRE ATT&CK so your detection team can act on it directly.
Archives built in temp directories, databases dumped, file shares enumerated in bulk. Staging volume is often the closest thing to a measurement of what the attacker intended to take.
Outbound volume and destination from flow records, cloud storage uploads, mail rules, and anonymised egress. Where the only evidence is volume rather than content, we report volume and say that content was not recoverable.
A firewall on local time, a domain controller on UTC, a SaaS log in the tenant's configured zone and an endpoint whose NTP drifted eleven seconds. Every source is normalised to UTC with its offset recorded, and the correction is shown rather than assumed.
Deleted does not always mean gone. Journal records, shadow copies, unallocated space and SQLite write-ahead logs regularly carry the artifact somebody believed they had removed. They also regularly do not, and we will not imply recovery is a certainty before we have looked.
The report is written for a hostile reader working through it line by line, looking for the sentence that overreaches. So it never mixes the three things most incident reports blend into one confident narrative.
Facts tied to a specific artifact, with the source, the timestamp and the image it came from cited next to each one.
Reasoned conclusions drawn from those facts, labelled as inference, with the reasoning shown and the confidence stated.
The questions the evidence could not answer, and why: the log that had rolled, the host rebuilt before we arrived, the encrypted channel we can size but not read. Most reports quietly omit this section. It is the one your counsel will value.
Full narrative, per-host findings, the complete timeline in UTC, indicators of compromise, and the method and tooling used for each step so another examiner could repeat it.
What happened, what was affected, what is known about data leaving, and what is still open. Written to be read by a board or a regulator without a translator.
Item list, acquisition hashes, custody log and the storage location of each image, so the provenance of every claim is checkable.
The specific changes that close the path that was used, separated from the investigative findings so the two are never confused in a disclosure.
Typical timing: acquisition within the first 24 to 48 hours, a verbal interim on day three to five, and a written report in two to four weeks depending on host count and evidence volume.
In a forensic matter the party paying for the work usually has a conclusion they are hoping for. That changes nothing about what goes in the report.
Not for the party paying, not for the party under pressure, not to make a filing deadline simpler. If the artifacts support "an account was used" but not "this person used it", the report says the first and refuses the second.
If the evidence is not going to establish what you need, you hear it in the interim call, while you can still decide whether to continue spending on it.
Where a matter is or may become legal, your lawyers direct the engagement and receive the output. We will not advise you on privilege, notification obligations or regulatory deadlines. That is their work and we will say so rather than guess.
No client names, no sanitised case studies, no conference talk with the details filed off. The absence of logos on this site is the policy, not a gap.
Isolate at the network, not at the power switch: pull the cable or move the port to a quarantine VLAN and leave the machine running. Do not log in to "check", do not run antivirus or a cleanup tool, do not reboot, do not reset the suspected account's password yet. Extend log retention on the firewall, the identity provider and the mail platform immediately, because those are already counting down. Write a plain list of what has been done so far, including the things someone did in a panic, and keep it honest: knowing a technician ran a cleanup at 02:40 is far more useful to us than discovering it in the artifacts a week later.
You can, and sometimes it is the right trade, but it ends the investigation for those hosts. Rebuilt machines cannot tell you how the attacker got in, so you may be restoring into the same open door, and you will not be able to answer a regulator asking which records were accessed. The usual compromise is fast acquisition first: an image and a memory capture per affected host takes hours, not days, after which rebuild whatever you need. If business pressure makes immediate rebuild unavoidable, tell us which hosts went and when, and the report will record what could not be examined as a result.
We work to the handling standards that make that possible: write-blocked acquisition, hashes recorded at capture and verified at every transfer, a signed custody log, analysis on copies, and a method section detailed enough for another examiner to repeat the work and reach the same result. Admissibility itself is decided by the forum and by your counsel, not by a vendor, and any firm promising you otherwise is selling something. What we can commit to is that the record will not be the weak point.
The report says what the artifacts show, and no more than that. We are careful about the gap between a credential or a device being used and a named human being at the keyboard, because that gap is where internal investigations go wrong and where employment claims are won. Findings on individuals go to your counsel or the engagement sponsor named in the scope, not into a wider distribution, and we will not interview your staff, run an HR process or make a recommendation about anyone's employment.
Acquisition is usually the first 24 to 48 hours. A verbal interim with the early timeline typically lands on day three to five, because you will have decisions to make before the report exists. A written report for a contained incident across a handful of hosts is normally two to three weeks; a large estate, heavy cloud log volume or a litigation-grade deliverable runs longer. We give a range after triage, update it if it changes, and tell you what is driving the delay rather than letting the date drift.
We investigate, and we write the containment and hardening notes that follow from what we found. Where you need hands rebuilding the estate at the same time, that is usually your team or your MSP working in parallel, and we will coordinate with them on sequencing so that remediation does not destroy evidence we have not captured yet.
CobaltLoom