What was taken? How did they get in? Are they still inside? Can we prove it? PITOWINGS answers those four questions with evidence — acquired without touching the original, sourced to named artefacts, and documented so it holds up in a boardroom or a courtroom.
24 / 7
Incident response line
8
Forensic service lines
6
Evidence stores covered
ISO 27001
Certified organisation
Forensic acquisition
Write-blockedSource
/dev/sda
931.51 GB · HDD
read only
Image
evidence.E01
awaiting
Verification pending
The original was never written to. The copy is provably identical.
Incident in progress
24/7 response line — do not power anything off
Evidence we acquire and examine
RFC 3227 sets the order in which digital evidence has to be collected, because the top of the list disappears in seconds and the bottom of it survives for years. Every hour spent deciding whether to call someone is paid for at the top.
CPU registers & cache
nanosecondsRouting tables, ARP, process table
secondsRAM — keys, injected code, live sessions
until power lossTemporary files & swap
hoursDisk — files, slack, unallocated
until overwrittenRemote & cloud logs
retention windowBackups & archival media
yearsCollect top-down. Everything above the line you reach is already gone.
Rebooting, reimaging or running an antivirus sweep destroys the memory, the temp files and the timestamps that explain the intrusion. Containment and preservation can run together — but only if preservation starts first.
Pulling power throws away the top three rows of the volatility list. Network isolation stops the attacker while keeping the volatile evidence alive for capture.
Firewall, proxy, VPN and cloud audit logs roll off on a retention clock that does not care about your investigation. Extending retention on day one is often what makes attribution possible on day ten.
An intrusion rarely lives in one place. These run together on a single engagement, so the disk, the memory, the wire and the cloud tenant are read as one story rather than four reports.
First hour
Rapid triage, scoping and containment when an attack is live — cutting the attacker's reach without destroying the evidence that explains how they got it. Ransomware, extortion, business email compromise and insider events.
What it recovers
Forensically sound acquisition and examination of servers, workstations and storage media. Every image is taken behind a write-blocker and verified by hash, so the analysis is performed on a copy that is provably identical to the original.
What it recovers
Volatile capture
Capture and analysis of live memory, where the things attackers try hardest to keep off disk actually live — injected code, unpacked payloads, encryption keys, open handles and active sessions. Paired with static and dynamic analysis of the sample itself.
What it recovers
Reconstruction of what crossed the wire — packet captures, NetFlow, proxy, DNS and TLS metadata — to establish command and control, lateral movement and exactly what volume of data left the estate, and when.
What it recovers
Logical and physical extraction from phones, tablets, wearables and IoT devices, followed by examination of messages, call records, location history, application databases and records the user believed were deleted.
What it recovers
Investigation where there is no disk to seize: tenant audit trails, sign-in and conditional-access logs, API activity, mailbox rules, OAuth grants, snapshots and configuration history across Microsoft 365, Google Workspace, AWS, Azure and GCP.
What it recovers
Tracing fraud through its money trail and its identity trail — cryptocurrency flows across wallets and exchanges, mule account chains, social engineering campaigns, impersonation and identity theft — assembled into a case a bank, an insurer or a court can act on.
What it recovers
Before it happens
The work that makes the next investigation fast: logging and retention reviewed against what an investigation actually needs, response playbooks rehearsed, and a compromise assessment to answer the question most organisations have never asked — is someone already inside?
What it recovers
A worked example. The difference between a forensic timeline and a plausible story is that each row here names the evidence it was proven from — and any competent examiner can reproduce it from the same image.
Invoice attachment opened by a finance user.
Macro writes a loader into the user's temp directory and runs it.
A scheduled task is registered to survive reboot.
Cached credentials reused against three file servers over SMB.
2.3 GB staged into an archive under a logging directory.
Archive uploaded over HTTPS to an unrecognised endpoint.
Illustrative reconstruction. Real engagement findings are confidential to the client.
Modern intrusions deliberately avoid the places people look. We collect across all six stores, because the half of the attack that never touched a file is usually the half that matters.
Disk
$MFT · USN journal · slack · unallocated
Memory
process list · injected code · keys · sessions
Network
PCAP · NetFlow · proxy · DNS · TLS SNI
System
registry · event logs · prefetch · amcache
Mobile
app databases · location · deleted records
Cloud
audit trails · sign-ins · API calls · snapshots
Chain of custody · EX-0417
UnbrokenSeized
On-site responder
Device photographed, bagged, tagged EX-0417.
Transferred
Custody officer
Sealed transport, signed handover, time-stamped.
Imaged
Forensic examiner
Write-blocked acquisition, hash recorded at source.
Examined
Forensic examiner
Analysis performed on the copy. Original untouched.
Reported
Lead investigator
Findings, method and limitations stated in full.
Returned
Custody officer
Evidence returned or retained under written instruction.
Findings that cannot be traced back to an untouched original are an opinion. Six practices turn an investigation into evidence, and they are followed on every engagement — not only the ones that look likely to reach a court.
An incident that ends at 'systems restored' is an incident you will have again. The engagement closes on root cause and the control that stops the repeat.
Prepare
Playbooks, contacts, retention and access agreed before hour zero.
Identify
Confirm it is real, establish scope, and stop the guessing.
Contain
Cut the attacker's reach without destroying the evidence of it.
Eradicate
Remove persistence, rotate what was exposed, close the entry.
Recover
Restore under monitoring, and prove the environment is clean.
Learn
Root cause, written findings, and the control that stops the repeat.
Every line in a PITOWINGS timeline names the artefact it was proven from. If we cannot source it, we mark it as inference and say so — which is exactly what makes the rest of the report hold up.
The team that reconstructs the breach is the team that builds our detection products. Root cause does not stop at 'phishing email' — it ends at the control that would have caught it.
Custody, hashing, documentation and repeatability follow ISO/IEC 27037 and 27042 and NIST SP 800-86 on every engagement, not only on the ones that look like they might reach a court.
A technical report an engineer can act on, and an executive summary a board, an insurer or a regulator can read — because an investigation nobody can act on is an expensive archive.
Containment, eradication and monitored recovery are part of the engagement. We do not hand over a diagnosis and leave the patient in the room.
Engagements run in your facility, over a secure remote channel, or entirely offline for regulated and classified environments where nothing may leave the building.
Isolate affected systems from the network but do not power them off, stop any reimaging or clean-up, extend log retention on your firewall, proxy, VPN and cloud tenant, and call an investigator. Powering off destroys memory evidence and clean-up destroys the timeline.
Yes, when it is collected correctly. We acquire behind a write-blocker, hash at source, maintain a signed chain of custody, and document method and limitations in full — and we provide the certificate for electronic records required under Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Indian Evidence Act.
Yes. Where there is no disk to seize, the evidence is in tenant audit trails, sign-in and conditional-access logs, API activity, mailbox rules, OAuth grants, snapshots and configuration history. We investigate across Microsoft 365, Google Workspace, AWS, Azure and GCP.
Our incident response line runs 24/7. Remote triage typically begins within the hour, and on-site acquisition is arranged from Coimbatore and Bengaluru across India depending on scope and location.
We trace flows across wallets, mixers and exchanges, identify off-ramps and build the evidence package a bank, insurer or law enforcement agency needs. Recovery itself depends on cooperation from the exchange and the relevant authority.
Not listed here? Ask the forensics team directly.
Talk to our forensic team today, confidentially and without delay. If an attack is live, call the response line first and preserve before you clean.
