The attack happened. Now we need the truth.
Forensic incident investigation with a rigorous chain of custody. We identify what happened, how it happened and who did it, with court-admissible evidence.
Cases we investigate
Every incident is unique. Our team has experience across a wide range of compromise scenarios.
Ransomware
Identifying the variant, entry vector, affected data and the feasibility of recovery without paying the ransom.
Data Breach
Determining the exact scope of the breach, exfiltrated data, source of the leak and notification obligations (LGPD/ANPD).
Insider Fraud
Investigating suspect employees, collecting digital evidence and producing a report for legal use.
Email Compromise
Business Email Compromise (BEC), header analysis, tracing of redirect rules and credential compromise.
Network Intrusion
Complete mapping of the unauthorized access, installed persistence and compromised systems.
Targeted Malware
Analysis of custom malware or APT. Reverse engineering, C2 infrastructure and attribution when possible.
Technical capabilities
Incident Response
- Immediate containment and eradication
- Root-cause analysis
- Entry-vector identification
- Attack timeline
- Assessment of exfiltrated data
- Secure system restoration
Malware Analysis
- Static and dynamic analysis
- Sandboxing and controlled detonation
- Reverse engineering of samples
- C2 and infrastructure identification
- IOCs for immediate blocking
- Detailed technical report
Endpoint Forensics
- Forensic memory (RAM) collection
- Disk analysis, artifacts and logs
- Recovery of deleted files
- Windows registry analysis
- Prefetch, MFT, shimcache, amcache
- Documented chain of custody
Court Report
- Admissible expert technical report
- Rigorous chain of custody
- Hashing and evidence integrity
- Compatible with civil and criminal cases
- Expert assistant at hearings
- Format accepted by Brazilian courts
Response process
Emergency Response
PRIORITYImmediate response, team mobilized within 2 hours. Immediate remote guidance for containment before arriving on site.
Evidence Preservation
Forensic collection with certified tools. Chain of custody started immediately. No evidence altered or contaminated.
Technical Analysis
In-depth analysis of memory, disk, network logs and endpoints. Reconstruction of the attack timeline.
Containment and Eradication
Removing the adversary's access, cleaning backdoors, hardening the environment before restoration.
Executive Report + Court Report
Two documents: a technical report (for forensics / legal) + an executive report (for leadership). Clarity at every level.
In an active incident right now?
Do not shut down the systems, do not try to clean up. Contact us immediately, every minute counts to preserve evidence.