When do you need this service?
- An intrusion whose entry point and reach still have to be established
- An internal incident where it matters which files were copied or deleted, and when
- A system compromised by malware that needs to be understood before rebuilding it
- Recovery of activity traces on a device after data has been deleted
- Confirming whether attackers took data before encrypting
Technical process
- A forensic-grade image of the media, so that the original is never worked on directly
- Technical evaluation of the scope of the investigation. This stage has a cost.
- A technical report and a quotation covering the lab hours and specialists the case requires
- Reconstruction of the timeline from file system metadata, logs and system artefacts
- Recovery of deleted content and of traces left in unallocated space
- Delivery of a technical document describing the findings and the method used to reach them
Frequently asked questions
Is the resulting document valid in court?
No, and we want to be explicit about that. What we deliver is a technical analysis for your own decision-making. An opinion with standing before a court requires an accredited expert appointed under the relevant procedure, which is a different service that we do not provide.
Can you tell who was responsible?
We can establish what happened on the system: which account was used, from where, and at what time. Attributing that to a person is a conclusion that belongs to your own investigation, not to the technical analysis.
Does the analysis alter the original device?
No. All work is done on a forensic image. The original is preserved exactly as it was received.
What does the initial evaluation cost?
The technical evaluation has a cost, because it involves specialist diagnostic time. Its findings determine the report and the quotation.
Do you need to establish what happened on a system?
Write to us and we will get back to you straight away, 24/7/365.
We answer in English by email and WhatsApp. Phone calls are answered in Spanish.
Related services
Is this for you or for your organisation? For businesses and institutions we work with a signed confidentiality agreement, formal invoicing and priority 24/7 support.