Forensic triage
From Rp 30 million
- Rapid assessment of an active incident
- Initial scope of compromise and indicators of attack
- High-priority containment recommendations
Digital forensics
Digital forensics and incident response
When an incident happens, the speed and accuracy of the investigation decide how much damage it does. We help your team contain the threat, secure evidence, understand the attack timeline and plan a measured recovery.
- Priority
- Active incidents
- Timeline
- Set by scope
- From
- Rp 30 million
FrameworksISO/IEC 27037NIST SP 800-86NIST SP 800-61 Rev. 3
01
Scope of work
Each engagement is shaped by the type of incident and the systems affected.
01
Triage and containment
Establish the extent of the compromise and the priority containment steps so the damage does not spread.
02
Evidence acquisition
Evidence is collected with hash verification and a chain-of-custody record so its integrity can be relied on.
03
Artefact analysis
Logs, endpoint artefacts and network traces are analysed to reconstruct what the attacker did.
04
Root cause analysis
Entry point, lateral movement and affected assets are mapped.
05
Post-incident hardening
Recommendations to strengthen controls so a similar incident does not recur.
06
Reporting and briefing
A technical report and an executive summary for management, auditors or legal proceedings.
02
Packages
Full forensic investigation
From Rp 85 million
- Evidence acquisition with chain of custody
- Attack timeline and root cause analysis
- Technical report and executive incident report
Incident recovery programme
By proposal
- Recovery playbook and service restoration
- Post-incident control hardening
- Tabletop exercise and readiness improvement
Final prices are confirmed after scoping and depend on the number of systems, log sources and the depth of analysis.
03
How the investigation runs
First report
We collect what is known about the incident, the affected systems and any constraints.
Containment
Immediate steps to stop the spread without destroying evidence.
Evidence acquisition
Evidence is collected and hash-verified; every transfer is recorded in the chain of custody.
Analysis
The timeline is rebuilt from logs, endpoint artefacts and network traffic.
Reporting and recovery
Findings are presented to technical staff and management, with a recovery and prevention plan.
04
What you receive
- Evidence-based incident timeline
- Entry point, lateral movement and impact on assets
- Chain-of-custody record for every item of evidence
- Technical investigation report and management summary
- Recovery plan and measures to prevent recurrence
05
Frequently asked questions
When does a company need digital forensics?
When there are signs of compromise, a data leak, ransomware or internal fraud, or when the organisation needs an objective, evidence-based account of what happened.
How is incident response different from digital forensics?
Incident response focuses on containment, eradication and recovery so services return to normal quickly. Digital forensics focuses on collecting, validating and analysing evidence to understand the root cause and support audits or legal proceedings.
Do you follow a chain of custody?
Yes. Every acquisition is documented and hash-verified so the integrity of the evidence is preserved.
How long does an investigation take?
It depends on the scope: the complexity of the environment, the number of endpoints and log sources, and the depth of analysis needed. We give a time estimate after scoping.
06
Need an incident investigated now?
For an incident in progress, call our main number and choose “Security incident” on the form. We will help you decide the fastest containment and recovery steps.
Report an incident