Managed XDR

Digital Forensics & eDiscovery

Digital evidence for legal, HR and regulatory matters, collected and kept under a strict chain of custody.

Digital evidence you can rely on in a legal, HR or regulatory matter.

Some matters turn on digital evidence even when there is no attack under way. A legal case, an HR investigation or a question from a regulator may depend on what happened on a device, in a mailbox or in a cloud account. We find that evidence, collect it to a set protocol and keep a strict chain of custody from start to finish. You get a full written report that your lawyers, regulators and insurers can review.

Digital Forensics & eDiscovery

Investigations for matters that are not an active attack.

Our operations team handles digital forensics during and after a cyber attack. This service investigates legal, HR and regulatory matters, where people outside the business must be able to rely on the evidence.

Forensics during an incident

  • Legal cases

    Evidence collected and preserved to a set protocol, with a written report your lawyers can use.

  • HR investigations

    A factual record of what happened on a device or account, checked with hash values to show nothing was changed.

  • Regulatory matters

    Findings set out for review by regulators such as the OAIC or APRA.

  • Insurer review

    A report your insurer can review, backed by the evidence and its chain of custody.

Finding the email, files and logs a matter turns on.

eDiscovery means finding, holding and producing the electronic records that relate to a matter. Much of that content now sits in Microsoft 365, and in the security logs your systems keep.

Our Microsoft services

  • Microsoft 365

    Microsoft Purview includes eDiscovery tools, alongside data governance, insider risk and data loss prevention. We set up and improve Purview as part of our Microsoft services.

  • Security logs

    Logs held in one place, such as a SIEM or Palo Alto Networks Cortex Data Lake, support forensic analysis of who did what, and when.

  • Devices and cloud

    We collect evidence from disk, memory, cloud services, SaaS applications and mobile devices.

Four stages, so the findings hold up later.

We handle evidence the same way on every matter, whether we collect it on site or remotely.

  1. Step 1: Identification

    A careful, step-by-step review, using the right tools, to find what evidence exists and where it is.

  2. Step 2: Collection

    We acquire evidence to a set protocol, take forensic images, move evidence securely and can collect it remotely.

  3. Step 3: Preservation

    We store evidence securely, keep the chain of custody and check hash values to prove nothing has changed.

  4. Step 4: Analysis

    Expert analysis with advanced forensic tools and hands-on manual checks, ending in a full written report.

What you receive.

  • Evidence collected to a documented protocol, on site or remotely

  • A chain-of-custody record for every item

  • Hash values that show the evidence has not changed

  • Secure storage of the evidence

  • A full written report for your lawyers, regulators or insurers

Questions about forensic investigations.

How is this different from your incident forensics?

Our incident forensics works during and after a cyber attack, to find out what happened and support the response. This service is for legal, HR and regulatory matters, where there may be no attack at all. The same team does both, with the same four-stage evidence handling.

Can you collect evidence remotely?

Yes. We can collect evidence remotely as well as on site, and we move physical evidence by secure means.

How do you show the evidence hasn’t been changed?

We keep a chain-of-custody record for every item and check its hash value. A hash is a digital fingerprint of the data. If the data changes, the hash no longer matches.

What if the investigation finds signs of an attack?

Then it becomes a security incident. Our incident response team is on call 24/7 to contain it, limit the damage and get you back to normal.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.