Contact us

Digital Forensics

Part of Incident Response Services

When you need to know what happened, who did it and what they touched, the answer is in the evidence. We collect it carefully, analyze it thoroughly and report it clearly.

Discuss an investigation

What we analyze

  • Endpoints and servers: execution, persistence, user activity, file access and remote-access tools.
  • Microsoft 365 and identity logs: sign-ins, audit events, mailbox activity and app grants.
  • Cloud and network logs: where available, to place activity in context.
  • Malware and threat actor tooling: triage to understand capabilities and indicators.

How we work

  • Secure evidence collection. Case-specific collection tooling, encrypted transfer and documented chain of custody.
  • Defensible findings. Each finding is tied to its source artifact. We separate what the evidence proves from what it only suggests.
  • Timelines. Events from multiple sources merged into one sequence you can follow.
  • Indicators. Compromise indicators you can use to search the rest of your environment.

What you receive

  • Forensic timeline
  • Indicators of compromise
  • Findings report in plain English, with technical detail for your team
  • Support for questions from leadership, insurers, auditors and counsel

Typical reasons to call

  • A suspected account or system compromise
  • Insider activity or policy violation questions
  • Confirming whether an incident reached data or other systems
  • Validating that a remediation actually removed the threat actor

Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Talk to an incident responder

Book a free 30-minute incident response call, or call our 24/7 staffed hotline at 231-350-3171. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.

Book a free 30-minute IR call