We investigate the incident and, when the case reaches the courts, turn the findings into formal evidence that an accredited expert confirms and defends before the tribunal.
Three service lines you can hire alone or together. Pick the situation closest to yours.
We join your team and run the forensic and response processes as if they were your own in-house service.
Who it is forFor organisations that want ongoing DFIR capability without building their own team.
The incident has already happened and you need someone to run the analysis: we identify, acquire, preserve and analyse the evidence.
Who it is forFor organisations with a recent or ongoing incident. Engaged case by case: you tell us about it and we prepare a proposal.
The legal projection of the analysis: its technical findings become formal evidence that an expert confirms and defends before the tribunal.
Who it is forFor organisations, lawyers and individuals with a case under way or about to start.
A forensic analysis is not a stand-alone job: it is one stage of incident management. That is why we organise it along the lifecycle the standards describe, and every finding feeds back into the incident.
Roles, procedures, tools and forensic readiness in place before the incident.
We define roles, procedures and tools, and set up how evidence will be preserved before it is needed.
An event is recognised, logged and escalated.
We set how an event is logged, who receives it and when it is escalated, so no hours or traces are lost.
It is determined whether it is an incident, how serious it is and which obligations it triggers.
We help decide whether it is an incident, how serious it is and which reports or notices it requires.
Containment, eradication and recovery without destroying evidence.
Contain and recover without erasing the trail: every technical action is logged and coordinated with the analysis.
Identify, acquire, preserve and analyse the evidence: what happened, how and, as far as it allows, who.
We acquire verified copies, analyse them and reconstruct what happened, how and, as far as the evidence allows, who.
What was found improves the controls and feeds preparation.
We turn what was found into concrete improvements to controls, procedures and training.
Law 21,663 sets reporting deadlines to the authority that do not wait for the analysis to finish.
Which deadlines apply to you depends on your organisation's status; we determine it case by case.We use the ISO standards as a working method; they are only named here, not reproduced.
An internal forensic analysis only becomes expert evidence when it is adapted to what the courts require: formal evidence, chain of custody, documentation and an expert who confirms and defends it.
Report confirmed by the expert
Without alignment, a sound technical analysis may not hold up before a tribunal.
Does a forensic analysis of your case already exist?
Not all evidence gathered during an incident will stand up in court. We would rather you know before taking it to trial.
Sample document with fictitious data. The animation shows how a technical finding becomes an expert report, point by point.
| Case | case no.: [pending]Case C-0000-2026 (sample case) |
|---|
| Item | SHA-256 fingerprint | Custody |
|---|---|---|
| sda.imgE-014 · forensic image, disk 0 | 9f2c4ab7…9f2c4ab7…d3ef · verified | no recordRecord no. 1 · 3 transfers logged |
02:14 login svc_backupSign-in with valid credentials on 14 Oct at 02:14 (UTC-3).
timeline + hashTimeline built with verifiable tools; another expert can repeat it.
altered: yes/noQuestion 1: the email was not altered; the fingerprint matches the original.
Each type of case has its own procedural framework and report model. Pick one to see what applies and what evidence is typical.
Criminal Procedure Code
Dedicated report model for this type of case
Civil Procedure Code
Dedicated report model for this type of case
Labour Code
Dedicated report model for this type of case
Law 19,968 on Family Courts
Dedicated report model for this type of case
Expert evidence in IT cases usually starts from a prior forensic analysis. What changes is the standard: the first answers what happened; the second, what can be proven before a tribunal.
A verified forensic copy is identified and acquired; the original is left untouched.
E-014 · SHA-256 9f2c…d3ef
Every handover is logged: who receives it, when and with what fingerprint.
ACTA-001 · 3 → 3
Work is done on copies, reconstructing what happened, how and, as far as possible, who.
CT-014 · SHA-256 9f2c…d3ef
Findings and recommendations are delivered for managing the incident.
IT-014 · v1.0
We review whether evidence, custody and method meet the judicial standard.
EV-014 · v1.0
Any gaps are closed and the report is written with the structure of the proceeding.
IP-014 · v1.0
The expert confirms the report and answers before the tribunal.
AUD-014
If you expect the incident may end up in court, say so from day one: preserving to that standard from the start avoids losing evidence.
They can be hired separately or together.
Forensic analysis reconstructs what happened in an incident and serves the organisation's own management. Expert witness work brings it to the form a tribunal requires (formal evidence, chain of custody, documentation), and an expert confirms and defends it.
Yes. First we assess whether the evidence and custody meet the judicial standard. The result may be favourable or unfavourable; if unfavourable, we tell you what to revalidate or complete.
We do not offer a standing on-call service. If you want forensic capability ready before an incident, there is the «DFIR as an in-house service» line. If the incident has already happened, we take it on as an engagement: tell us about it in the quote tool and we prepare a proposal.
Avoid reinstalling, wiping or cleaning the devices and tell us before making changes: every action can alter evidence.
Criminal, civil, labour and family cases, using the report model of each proceeding.
It is quoted case by case: it depends on the number of devices, the volume of data and the scope. There is no list price.
Only the basics: which service you need, your situation and how to reach you. Case details and the people involved are handled afterwards, in confidence.
Cannot find your question? Tell us about your case in the quote tool and we will answer it with the proposal.
Your basket is empty
Add regulatory documentation packs or plans