Digital Forensics
Forensically sound evidence acquisition, analysis, chain-of-custody, and expert reporting — work product that holds up under scrutiny in legal and disciplinary proceedings.
Digital forensics is the disciplined recovery, preservation, and examination of digital evidence. Our remit covers the two evidence-focused stages of the wider DFIR cycle: Collect and Analyze. Containment, eradication, and recovery are handled separately under incident response so that the integrity of the evidence is never compromised by remediation work.
The Improbus Method (IMP)
The Improbus Method for Preservation of data, provenance and process — abbreviated IMP — is a repeatable, defensible workflow where every step is documented, timestamped, and verifiable.
- Pre-AssessEvaluate the situation with a quick pre-assessment — scope, severity, and immediate exposure.
- ContainStop the spread: Isolate affected systems, freeze and suspend compromised accounts and sessions, and preserve evidence.
- Emergency OperationsEnsure alternative core systems stay operational — NS, MX, WEB, FW, NMS, and more.
- CollectIdentify and preserve logs, traffic, system images, and artifacts under chain of custody.
- AnalyzeDetermine what happened, how, when, and who was involved.
- RemediateEradicate malware and footholds, close the root cause, and patch and harden.
- Rebuild and RestoreRebuild compromised systems and restore from clean, known-good backups.
- VerifyConfirm integrity, validate before return to production, and monitor for re-entry.
Evidence collection & acquisition
The first and most fragile stage: Capturing evidence before it changes. We work from the order of volatility outward, so that the most perishable data is secured first.
- Order of volatilityMemory and live state captured before disks; powered systems handled to preserve volatile artifacts.
- Write-blocked imagingHardware or software write-blockers prevent any change to the source media.
- Bit-for-bit imagesFull forensic images, not file copies — deleted data, slack space, and unallocated areas included.
- Cryptographic hashingAcquisition and verification hashes prove the image matches the source and never changed.
- Broad source coverageDisks, RAM, mobile devices, servers, cloud accounts, logs, and network captures.
- Sealed transportTamper-evident packaging and documented hand-off for every item moved.
- Live acquisitionCapture volatile memory and running state from systems that cannot be powered down.
- Photographic recordPhotograph devices, labels, and connections before and during seizure.
Chain of custody & preservation
Evidence is only as strong as the record that accompanies it. We document who handled each item, when, why, and how — an unbroken chain from seizure to courtroom.
- Custody logEvery transfer, access, and action recorded with date, time, and handler.
- Hash verificationIntegrity re-checked at each stage; any change is detectable and dated.
- Working copiesAnalysis runs on verified copies; the original master is never touched.
- Secure storageAccess-controlled, logged storage for originals and images alike.
Analysis & examination
Determine what happened, how, when, and who was involved — methodically, and within the bounds of the evidence. We test hypotheses rather than confirm assumptions.
- Timeline reconstructionCorrelate filesystem, log, and registry artifacts into a defensible sequence of events.
- Artifact recoveryRecover deleted files, fragments, and traces from slack and unallocated space.
- Filesystem & OS forensicsMetadata, registry, journals, and OS artifacts across Windows, macOS, and Linux.
- Malware & memory analysisExamine memory images and suspect binaries to establish behaviour and indicators.
- Mobile & cloudPhones, tablets, and cloud accounts within the lawful scope of the engagement.
- CorrelationCross-reference multiple sources to confirm or refute each hypothesis.
- Network forensicsReconstruct activity from packet captures, flow data, and firewall and proxy logs.
- Anti-forensics detectionSpot wiping, timestomping, and tampering that aim to hide what happened.
Reporting & expert testimony
Findings are only useful if they can be understood and relied upon. Our deliverables are written to be read by technical and non-technical audiences alike, and to withstand challenge.
- Independent reportMethodology, evidence handled, findings, conclusions, and stated limitations.
- ReproducibilityTimestamps, hashes, and documented steps so the work can be independently verified.
- Plain-language summaryAn executive summary for decision-makers alongside the technical detail.
- Expert testimonySworn or written expert evidence and clarification where engaged.