Incident Response

Support the response without losing the record.

We help your team preserve relevant evidence while coordinating containment and recovery. We identify sources that may change or disappear and plan collection around the realities of the incident.

Discuss preservation

Identify the records most likely to change.

An incident response can alter devices, accounts and logs before the investigation is complete. We help identify sources relevant to the suspected activity and prioritize those with short retention or a risk of being changed during response. The plan is tailored to the incident and must account for urgent operational and safety needs.

Coordinate collection with containment and restoration.

We work with the technical team to establish who is collecting each source and who is changing the environment. Relevant material may include affected devices, account records, available audit logs, original suspicious messages and response notes. Where immediate action is necessary, recording what changed, when and why helps the later examination interpret the evidence.

Preserve source context, not only screenshots.

A screenshot can capture an observation, but the underlying message, log export or supported device collection may contain additional context needed for analysis. We discuss suitable acquisition methods and their coverage. Sources already exported by another provider are documented as supplied, including available information about the collection method, time range and exclusions.

Maintain a controlled handling and transfer record.

We document source identifiers, collection details, transfers and verification appropriate to the material. We agree who may access the evidence and how it will be shared with the response team or advisers. This keeps important exports traceable rather than dispersed across personal accounts, informal chats and unrelated storage.

Explain what was not preserved and why.

Some sources may have expired, been overwritten or be unavailable within the permitted access. We record those limits and their likely effect on the investigation without implying that absent records prove no activity occurred. Counsel and the organization should confirm applicable preservation and retention requirements; collection does not itself settle every later review or disclosure decision.

RELEVANT SOURCES

Start with what is available.

We help you identify which available sources can answer your question, within an authorized scope.

Relevant devices and account recordsAvailable logs and short-retention sourcesResponse action and collection notes

BEFORE WE BEGIN

Here is what helps us understand your matter.

List affected sources, available logs and known retention windows.
Identify actions already taken or planned, including rebuilding and account changes.
Nominate technical contacts and authorized evidence recipients.
Agree collection priorities and secure transfers with DFI before distributing exports.

YOUR NEXT STEP

Bring clarity to the response.

Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.