SOC / NOC · Specialist service
Digital Forensics and incident analysis
After an incident, you need to establish what happened and how far the attacker’s actions may have extended. We preserve available evidence and perform analysis to answer specific technical and organisational questions.
Service scope
Digital forensics
The examination may cover logs, disk images, memory and suspicious files. Material selection depends on the objective, available traces and system condition. We document collection, transfer and analysis, clearly separating findings, hypotheses and evidence gaps.
Evidence preservation plan
We select sources relevant to the investigative questions, considering availability and the risk of losing or altering traces.
Collection and documentation
We record sources, collection and transfer methods, and steps needed to preserve integrity.
Technical analysis
We examine agreed material, correlate events and identify traces relevant to incident progression and scope.
Reporting findings
We describe confirmed observations, uncertainty, limitations and questions requiring more data or specialist work.
Project deliverables
What will your team receive?
- A register of collected and transferred material.
- Documented analytical activities.
- A timeline and findings report with limitations.
- Recommendations for further analysis and remediation.
Delivery conditions
What do we agree before starting?
- An agreed investigation objective and authority to access material.
- Access to specified systems or preserved data copies.
- Rules for retention, sharing and concluding work with the material.
How we work
From understanding the need to verifying the result.
Defining the objective and material
We agree questions, available sources and safe collection and transfer methods.
Examining traces
We conduct documented analysis, compare sources and test possible explanations for observed events.
Delivering results
We discuss findings, evidence gaps and recommendations for further incident handling.
Clear responsibilities
What is already included, and what do we extend?
SOC preserves basic operational evidence and analyses incidents using available telemetry. Digital Forensics adds in-depth examinations, specialist sources and separate investigative questions; it does not replace ongoing SOC response.
Before making a decision
Questions about digital forensics
Will analysis always reconstruct the entire attack?
No. Capabilities depend on preserved traces, retention, log quality and system changes. The report identifies what cannot be reliably determined.
Can an already restored server be analysed?
Available material can be examined, but recovery may have altered or removed traces. Agree evidence preservation before making further changes where possible.
Does every investigation include malware analysis?
The suspicious files and depth of analysis are agreed separately. The service does not provide unlimited analysis of every malware type.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.