Cybercrime investigations
Ransomware, financial fraud, data theft, personal and industrial espionage. We identify and interpret the artefacts that carry criminal relevance, document them so they hold up, and support your organisation in its dealings with investigating authorities.
Where we are useful
The investigation starts from what happened and stops where the evidence stops. We do not state conclusions the artefacts do not support.
Ransomware investigations
Identifying the source of the attack and the intrusion vectors, analysing the malicious code to establish the encryption mechanism, and advising on prevention — including specific hardening of the IT infrastructure that was used to get in.
Financial fraud investigations
Digital forensic analysis for cases of unauthorised transfers and financial manipulation.
- detecting fraudulent activity
- tracing attacker activity
- identifying the source and methodology
- providing evidence to the authorities
- measures to prevent recurrence
Data theft investigations
Identifying and analysing the security breaches that allowed unauthorised access to sensitive information, identifying those responsible, documenting the evidence for legal use, and implementing protection measures that prevent a similar incident.
Personal and industrial espionage
Personal: identifying technical artefacts and advising against unauthorised surveillance, unlawful data collection and privacy intrusion.
Industrial: identifying and analysing artefacts in companies where theft of intellectual property or trade secrets is suspected or confirmed, plus security measures and continuous monitoring.
How it runs
The most common reason an investigation goes nowhere is that logs had already rotated, systems had been rebuilt, or a machine was “cleaned” before anyone looked at it. The sequence of the first few hours matters more than the sophistication of the analysis that follows.
Intake
What happened, when, which systems are involved and what evidence still exists.
Preservation
Collecting and preserving evidence before it is altered or overwritten.
Analysis
Artefacts, logs, malicious code, traffic — reconstructing what the attacker did.
Documentation
A technical and evidentiary report, in a form suitable for criminal proceedings.
Remediation
The measures that close the vector used and prevent a repeat.
What you are left with
A documented reconstruction of the incident and a set of findings that withstands scrutiny, plus the concrete measures that stop the same scenario from repeating.
Cooperation with investigating bodies happens at the client’s request and with their consent. We do not substitute for the authorities and do not carry out activity beyond the legal framework — our role is technical: establishing what happened and documenting the proof.
- Technical report
- Reconstruction of the incident: intrusion vector, attacker activity, systems and data affected
- Evidence
- Artefacts identified and documented in a form suitable for a criminal complaint
- Indicators
- Indicators of compromise you can then search for across the rest of the infrastructure
- Remediation
- Prioritised measures to close the vector used and prevent recurrence
- Support
- Explaining technical matters to non-technical decision-makers and to authorities, throughout the proceedings
Published research
Practitioner experience in cybercrime investigation, with published work on the criminal relevance of digital artefacts. The same material is delivered in university and professional settings.
Frequently asked questions
01What do I do the moment I discover it?
Do not rebuild, reformat or “clean” the affected systems. Isolate them from the network but leave them powered on if possible, and preserve logs, emails and anything received from the attacker. Most evidence is lost in the first hours, to well-intentioned intervention.
02Can the findings be used in criminal proceedings?
We document the identified artefacts in a form intended for use in criminal proceedings and can provide technical clarification throughout. The decision to notify the authorities rests with the client; we cooperate with investigating bodies at their request and with their consent.
03Can you recover data encrypted by ransomware?
We analyse the encryption mechanism to establish whether recovery is technically possible — in many cases it is not, and we say so directly. What we can establish in every case is how the attacker got in, what they reached, and what must be closed so it does not happen again.
04How is this different from malware analysis?
Malware and fraud analysis answers “what is this file or this email, and what risk does it carry”. An investigation goes further: it reconstructs the incident as a whole and documents the evidence with criminal proceedings in mind.
05What comes after the investigation?
Closing the vector used is the first step. It is usually followed by security testing to check whether similar paths remain, and by staff training where the vector was a human one. For organisations in scope of NIS2, incident handling falls within the outsourced officer role.
Tell us what you have. Even a short description lets us say whether the evidence is likely to be recoverable.
Cases where evidence can still be preserved are prioritised. The initial conversation, to establish urgency and immediate steps, costs nothing.
- Phone
- +40 763 204 739
- [email protected]
- Response time
- One working day at most