From response to readiness

Act quickly, but avoid making unnecessary changes to affected systems. Preserve relevant logs, devices and records; document what has been observed; and activate your organisation’s incident response process. Early forensic involvement can help preserve evidence while determining what occurred, what systems or information were affected and what further action may be required.

Incident response focuses on containing, managing and recovering from a cyber incident. Digital forensics focuses on identifying, preserving and analysing evidence to establish what happened. The two disciplines frequently work together: incident response addresses the immediate threat while forensic investigation helps establish the facts and preserve evidence for subsequent action.

Forensic readiness is an organisation’s ability to identify, preserve and use digital evidence effectively when an incident occurs. It includes appropriate systems, logging, procedures, governance and response arrangements. Good forensic readiness can make investigations faster and more effective while reducing disruption and investigative costs. We are able to assist organisations with forensic readiness to prepare and provide useful tools and mechanisms to respond to cyber incidents

Yes. Our investigative processes are designed to preserve the integrity and evidential value of digital information. Findings can support internal investigations, regulatory matters, civil litigation and criminal proceedings, with reporting tailored to the purpose for which the evidence may be used. As forensic specialists, we are well prepared for legal proceedings compared to other traditional cyber security firms

Sometimes. A forensic investigation may identify evidence linking activity to particular accounts, devices, infrastructure or individuals. Attribution can be complex, however, and attackers may deliberately conceal or falsify their identity. We will distinguish between what the evidence establishes, what it suggests and what cannot reliably be determined. As many breaches are not specifically targeted, it is often likely that attacks originate from overseas in other jurisdictions.

Potentially. As licensed private investigators, ForenSys can assist organisations with discreet investigations into suspected fraud, misconduct and policy violations, including the forensic examination of systems, communications and digital records. Any investigation must be appropriately authorised and conducted within applicable legal, privacy and employment requirements.

Often, but not always. Forensic techniques may recover deleted or inaccessible information from computers, mobile devices and storage media, including some damaged or corrupted sources. The likelihood of recovery depends on factors such as the storage device, its condition, encryption, how the data was deleted and whether it has subsequently been overwritten.

It depends on the device, operating system, security configuration and lawful authority to access it. As a non-government entity we do not have access to the tools needed to break encryption on modern mobile devices. In almost all circumstances, we require the pin codes for devices that we examine.