Has a breach occurred?
Investigate signs of compromise and data movement.
NetSecurity Forensic Labs
Digital forensics & investigation services
Every trace tells a story.
Computer forensic investigations, managed detection and response, data breach investigations, malware analysis and incident response. Licensed and certified investigators, a secure lab and processes that withstand legal scrutiny.
Licensed & certified investigatorsSecure forensic laboratoryDefined quality assuranceLegally defensible processes
01 Digital & cyber forensics center of excellence
NetSecurity Forensic Labs
Complex questions. Disciplined investigation.
A secure, state-of-the-art facility for high-profile investigations and for research and development in endpoint security, staffed by forensic practitioners, security researchers and software developers.
Technical depth and a well-defined quality assurance program support investigations designed to withstand legal scrutiny. Our work spans computer architecture, operating-system internals, networks, cloud platforms and storage systems.
Research that advances the practice.
Malware research, product testing, forensic and anti-forensic techniques, emerging tools, security trends and attacker tactics, techniques and procedures inform our work.
That research produced our flagship innovation, the ThreatResponder® Platform, and its Malyzer™ module for malware analysts and forensic investigators.
Meet NetSecurity Forensic Labs02 Managed service
Managed endpoint detection & response
The investigation can start before the incident does.
Around-the-clock visibility into the threats facing your endpoints, from nation-state adversaries and hackers to insiders quietly taking confidential information or intellectual property.
Powered by ThreatResponder, our team connects endpoint activity with threat-intelligence enrichment to identify attacker behavior, respond to threats and guide proactive risk mitigation.
Discuss managed detection
Powered by ThreatResponder®Illustrative endpoint visibility
- 01Detect
Recognize sophisticated attacks and covert activity.
- 02Respond
Neutralize threats in any phase of the attack lifecycle.
- 03Strengthen
Mature your security program and stay compliant.
03 Investigation service
Computer forensic investigations
Reconstruct the activity. Reveal the evidence.
Were your systems used for criminal, unauthorized civil or policy-violating activity? We establish what was accessed, copied, changed or deleted, and whether an intruder was involved.
- 01Preserve the source
Scope the investigation and acquire the data with forensic methods, documenting how it is handled.
- 02Examine the artifacts
Examine system and application artifacts; recover deleted, hidden and encrypted files on Windows, macOS and Linux.
- 03Reconstruct the activity
Correlate system usage, communications and network activity to establish what happened to the data.
- 04Explain the findings
Report the findings and what they mean, supported by documented methods that stand up to legal scrutiny.
03 Scope of an investigation
Where evidence lives
Across devices. Across networks. Across the cloud.
We recover and analyze evidence from desktops, servers, network and mobile devices, IoT and embedded systems, cloud platforms and removable media, in a wide variety of formats. The question you need answered sets the scope.
- 01DevicePhysical media & endpoints
- Hard drives & storage media
- Mobile devicesSmartphones · tablets
- IoT devices
- Backup devices
- 02NetworkShared systems & communications
- Computer networks
- Email systems
- Database management systems
- 03CloudHosted platforms & services
- Cloud platforms & storage
- Cloud emailGoogle Workspace · Microsoft 365
OnWindows · macOS · Linux · embedded systems
What we investigate
- Business email compromise (BEC)
- Data breach & data loss
- Network hacking
- System intrusion & compromise
- Intellectual property theft
- Confidential information leakage
- Computer misuse
- Corporate policy violations
- Mobile-device investigations
- Malicious software & applications
- Encrypted, deleted & hidden file recovery
- Illicit content investigations
The specialists on your case
- Computer forensic specialists
- Computer hacking forensic investigators
- Malware analysts
- Incident handlers & responders
- Network forensic analysts
- Mobile-device forensic investigators
04 Investigation service
Data breach investigations
Suspicion is a signal. Evidence is the answer.
Suspect a compromise? Establish what happened, identify affected systems and understand the exposure.
Instead of mobilizing a brigade of incident responders, we deploy ThreatResponder agents to suspect systems or across the enterprise, and begin detecting breach and exfiltration activity within minutes. Our team helps detect threat actors, disrupt attacker infrastructure, evict adversaries and reduce the risk of another incident.
Where is the attacker?
Determine scope and support containment and response.
What needs to change?
Recommend ways to reduce the attack surface and prevent recurrence.
High-profile investigations for retail, gaming, technology, government and corporate environments.
Discuss a suspected breach05 Analysis service
Malware analysis
Take the threat apart. Understand what it can do.
Our developers, researchers and investigators have conducted thousands of computer investigations, some involving malicious software, others malware-less techniques. Five complementary techniques reveal what a sample can do, the risk it carries and how to mitigate it.
- 01Static analysisWhat is it?
Inspect the sample without running it: file structure, metadata and embedded indicators.
Never executed - 02Dynamic analysisWhat does it do?
Run it in a controlled environment and observe process activity, system changes and network behavior.
Executed in isolation - 03Code analysisHow does it work?
Examine program logic and functions to understand the actions the software can perform.
Logic & functions - 04Reverse engineeringWhat is it hiding?
Work back from the executable to uncover mechanisms, hidden functionality and evasion techniques.
Hidden functionality - 05Threat intelligenceWhere does it fit?
Connect the findings with known indicators and adversary techniques to add context and guide mitigation.
Indicators & techniques
The outcomeCapabilities · Risk · MitigationIn a legally defensible report
Expert analysis, platform-assisted. ThreatResponder® and its Malyzer™ module support our analysts with threat intelligence, machine learning and behavior rules. Experienced practitioners interpret the results.
Speak with a malware analyst06 Response & readiness
Cyber incident response & proactive services
Ready before. Decisive during. Stronger after.
Reduce business interruption with a response grounded in evidence.
Our experienced responders help evaluate, escalate, mitigate and contain incidents, from securing systems and networks to acquiring data and analyzing evidence. ThreatResponder automates collection, threat analytics and detection to support the investigation.
Build the capability.
Create, implement and roll out incident response policies, processes and capabilities. Prepare your organization to manage cyber incidents as part of its wider crisis readiness.
Contain. Preserve. Investigate.
Secure affected systems, forensically preserve data and investigate networks, operating systems, databases and other infrastructure to establish the extent of compromise.
Explain the full story.
Analyze the evidence to understand the actors and activity involved. Use the findings to improve response and help prevent future occurrences.
A clearer account of the incident.
WhoWhatWhenWhereWhyHow
Start with the right questions
Let's bring clarity
to your investigation.
Tell us what you need to understand. Our team can discuss the appropriate investigation, analysis or response service for your situation.