WHO WE SERVE / INSURERS & BREACH COUNSEL
Incident advice depends on facts that are often incomplete and still developing. We provide scoped forensic investigation and clear reporting to help insurers and breach counsel understand the evidence, direct further technical questions, and advise the affected organization.
HOW A FINDING IS EXPRESSED
What the examined records show.
What the evidence supports, with the reasoning explained.
What remains unknown or requires another source.
WHY DFI
An organization may be restoring systems while advisers need to understand the incident’s chronology, affected environment, and possible information exposure. We define the investigation questions, preserve agreed sources, and explain the evidentiary basis for the findings. Where a conclusion remains provisional, we identify what would be needed to support or challenge it.
We establish who instructs the work, who receives updates, what approvals apply, and how technical findings will be reported. That keeps the examination aligned with the engagement without confusing technical analysis with legal advice, coverage interpretation, or a guarantee of privilege.
WHERE WE CAN HELP
The incident and available records determine the scope. We do not present an attacker’s assertion or a missing log as a confirmed finding.
We compare available account, endpoint, network, and response records to establish the supported sequence. We separate observed activity from assumptions and describe where remediation or missing telemetry limits reconstruction.
We examine available access, transfer, and account evidence within scope, together with relevant system context. We distinguish supported findings from indicators that require corroboration and questions the available data cannot resolve.
We coordinate collection and reporting with the organization’s IT team and providers. Defined evidence requests, change context, and update recipients help the parties work from a consistent technical picture.
THE WORK, MADE CONCRETE
Our work supplies technical findings for the appropriate advisers. Legal, notification, policy, and coverage decisions remain with them.
| Investigation question | Evidence we may examine | Reporting distinction |
|---|---|---|
| What activity can be established? | Available device, identity, mailbox, cloud, and relevant network records. | Observed events versus interpretation; known chronology versus unobserved periods. |
| Which systems or accounts are implicated? | Relevant alerts, configuration, available logs, and the organization’s system context. | Confirmed involvement versus systems requiring further examination. |
| What is known about information access or movement? | Available access and transfer indicators, relevant files, and corroborating records. | Supported exposure findings versus indicators or unresolved uncertainty. |
| What affected the investigation? | Collection details, retention, permissions, containment actions and remediation history. | Evidence available at examination versus limitations on retrospective conclusions. |
COLLABORATION, WITH BOUNDARIES
Confirms instruction and reporting arrangements, scope approvals, and the questions relevant to its professional role.
Conducts the agreed technical investigation, reports the basis and limits of findings, and identifies outstanding evidence questions.
Confirm authorized access, supply system context and available records, and execute operational response actions within their responsibilities.
We agree the scope, authority, access, reporting, and responsibilities before the work proceeds.
WHAT YOU RECEIVE
We agree deliverables before work begins. The appropriate format depends on your purpose, the available evidence, and the engagement.
Questions, sources, collection priorities, reporting recipients, and approval arrangements.
Agreed updates showing established findings, provisional interpretations, and outstanding requests.
The examined sources, relevant chronology, methods, conclusions, and material limits.
A discussion of the findings and further questions within the engagement, without substituting for legal or insurance advice.
RELATED SERVICES
Digital Forensics
We explain digital evidence and technical opinions in a form you can use to make informed legal or organizational decisions. Our reporting connects the questions asked to the examination performed and the conclusions the evidence supports.
ExploreDigital Forensics
We preserve and examine relevant mailbox, attachment, and cloud activity records from authorized accounts. We help you connect communications and account activity to the event you need to understand.
ExploreDigital Forensics
We help you preserve the evidence your matter depends on. Together, we identify the relevant sources, confirm authority, and plan a documented collection that fits your questions and your operations.
ExploreRELATED ARTICLES
We share the questions and methods that can help you make a more informed next decision.
Article
Backups help you recover data, but your business needs more than restored servers. We explain how to connect virtual-server protection, tested dependencies, useful evidence and leadership decisions in your recovery preparation.
Prepare your people, decisions and specialist support for a ransomware incident, beyond backups.
Read article
Article
A familiar email thread does not authorize a payment. We explain how trusted callbacks, independent approval and a clear fraud response can help your team verify a request before money moves.
Help your team recognize and respond to suspicious changes in payment instructions.
Read articleA USEFUL FIRST CONVERSATION
For an active incident, contact DFI through incident help. We will discuss the instructions, available evidence, and appropriate engagement route before work begins.
Discuss an incidentKeep credentials and sensitive evidence out of the initial inquiry. We will agree a secure intake route if the matter proceeds.
These independent references provide general background. They do not endorse DFI or define the scope of an engagement.
Background on forensic processes and evidence sources; not legal advice.
Platform-specific background on why retention and licensing matter.
