Overview
UK insurers, legal advisers and regulators expect defensible evidence after an incident. We collect and preserve evidence with documented chain of custody, reconstruct what happened and assess which personal data may have been affected, so that your UK GDPR decisions are based on facts.
After a security incident, leadership, insurers, regulators and sometimes courts need clear answers: How did attackers get in? What did they access? Is the threat gone? Digital forensics provides those answers through careful, evidence-based investigation.
Our analysts collect and preserve evidence from endpoints, servers, memory, cloud platforms, email systems and logs using forensically sound methods and documented chain of custody. We reconstruct attacker timelines, determine root cause and data impact, and analyse malware samples to understand capabilities, persistence and indicators of compromise.
Forensic investigations are available as part of active incident response or as standalone investigations, such as insider threat or suspected data theft.
Incident response for UK organisations
- Facts gathered quickly so your DPO can decide on 72-hour ICO breach reporting
- We work alongside your insurer's appointed responders and legal advisers where a policy requires it
- Support with NIS Regulations reporting and with reporting cyber crime to Action Fraud or Police Scotland
- Clear executive summaries for boards, customers and regulators, written in plain English
What's included
Our approach
- ScopeDefine questions, systems and legal considerations.
- PreserveCollect evidence forensically with chain of custody.
- AnalyseTimeline reconstruction and malware analysis.
- ConcludeRoot cause, scope and data impact.
- ReportClear reports for each audience.
What you receive
- Chain-of-custody documentation
- Attack timeline
- Malware analysis report and IOCs
- Data impact assessment
- Executive and technical reports
Standards & frameworks
- NIST SP 800-86
- ISO/IEC 27037
- ISO/IEC 27035
- MITRE ATT&CK
- NCSC incident management guidance
Frequently asked questions
Should we turn off infected computers?
Avoid powering off systems before speaking with responders — volatile memory can contain critical evidence. Isolate them from the network instead.
Can your reports be used in legal proceedings?
We follow forensically sound practices and document chain of custody; work with your legal counsel on specific requirements.
Do you analyse malware samples we send you?
Yes. Submit samples through a secure channel agreed with our team.
Can you help with ICO breach reporting?
We help you establish the facts the ICO asks for, such as what happened, what data and how many people were affected, and what you have done in response, so that your DPO or legal adviser can decide whether a report is required within 72 hours. The decision to notify, and the notification itself, remain yours.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.