Digital forensics and incident response tooling
When an incident happens, the first hours decide how much can be learned and how much evidence survives. Forensics tooling captures memory and disks in a defensible way, reconstructs what the attacker did and shares the indicators so the same attack can be found elsewhere.
What we do
- Evidence preservation and chain of custody
- Memory and disk analysis
- Log collection and timeline building
- Indicator extraction and sweep
- ATT&CK-mapped incident report
- Coordination with insurers and counsel
- Post-incident improvement plan
Our team works with Volatility for memory analysis, with Autopsy and The Sleuth Kit for disk and file system examination, with MISP to store and share indicators of compromise, and with the MITRE ATT&CK knowledge base to describe attacker behaviour in a common language. We also use the logs the customer already has, such as Windows event logs, firewall records and Microsoft 365 audit data, and we preserve them before they roll over.
This group links to our Cybersecurity practice. Evidence handling depends on a written scope and authorization, and where law enforcement or insurers are involved we follow their instructions. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Volatility
- Autopsy
- MISP
- MITRE ATT&CK
- Velociraptor
- KAPE
Platforms and practices
- Memory capture and Volatility analysis
- Disk imaging and Autopsy timelines
- Windows event log analysis
- Microsoft 365 audit log collection
- Indicator sharing in MISP
- MITRE ATT&CK mapping of findings
- Chain of custody records
- Containment and recovery plan
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Digital forensics and incident response tooling for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreDisaster Recovery Planning
Know how long you can be down, and prove you can come back before the day you must.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat should we do first if we suspect a breach?
Keep the affected systems as they are where you can. Do not wipe or rebuild them, and avoid powering a machine off if memory evidence matters, since memory is lost at shutdown. Isolate it from the network instead, save relevant logs, write down what you saw and when, and call your incident response contact. Check with counsel and your insurer about notification.
Why is memory capture important?
Memory can hold things that are never written to disk, such as running malware, network connections, encryption keys and credentials in use. Analysis with a tool such as Volatility can reveal them. It must be captured before shutdown, which is why speed matters in the first hours.
How long are logs available?
It varies, and many roll over quickly. Windows event logs overwrite when full, firewalls keep limited history, and Microsoft 365 audit retention depends on the licence and settings. We recommend setting retention and central collection before an incident, and during one we preserve what exists first.
Can you work with our insurer or law enforcement?
Yes. Evidence handling follows a written scope and chain of custody, and where an insurer, counsel or law enforcement directs the process we follow their instructions. Some insurance policies require approved responders, so check your policy before the day you need it.