Forensic investigation for companies

Data leak, suspicious activity, disputed document or compromised account: we analyse the digital traces to understand what happened and reach documented conclusions.

Describe your situationSee our services
Understand

What is corporate forensic investigation?

Forensic investigation within an organisation means collecting, preserving and examining data from your systems in order to reconstruct what really happened and draw verifiable technical evidence from it.

  1. 1

    Preserve the traces

    Before any analysis, the relevant data must be preserved to prevent it from being altered or lost. This step maintains the integrity of the evidence the investigation will rely on.

  2. 2

    Acquire and analyse the data

    We collect the relevant data using a documented method, then cross-reference traces from workstations, accounts, logs, files and cloud environments to reconstruct the events.

  3. 3

    Establish the facts

    The analysis distinguishes what the data establishes, what it suggests and what it does not allow us to conclude. Findings are documented and placed in their timeline.

Do any of these situations sound familiar?

Is your situation different?

Every incident has its own context. Tell us what you have observed, which systems are involved and what you are trying to establish: we will tell you which investigations are possible.

Describe your situation
Our services

Our corporate services

Cyberattack, data leak, internal fraud, dispute… These are the main digital investigations our forensics team carries out for companies.

  1. 1 / 5Active compromise

    Investigation of a compromised M365 account or environment

    Situation

    A business Microsoft 365 account or environment is compromised.

    Objective

    Confirm or rule out the compromise, identify the attack vector, the data accessed or exfiltrated, the actions taken by the attacker and whether there was any lateral movement. Regain control while preserving the traces. Produce a usable file for your insurer, a criminal complaint or any other competent authority.

    Example activities

    • Emergency measures: implementing the priority actions
    • Recommendations and support for containment measures
    • Support with the technical handling of the incident
    • Preservation of traces (required if a complaint is filed)
    • Search for persistence mechanisms
    • Analysis of the affected device (depending on findings)
    • Scoping the extent of the compromise
    • Debrief and recommendations for preventive and corrective measures

    Is the attack still under way? Our CSIRT can step in urgently to contain the incident and secure the environment, while preserving the traces the investigation needs.

    CSIRT emergency
  2. 2 / 5

    Workstation acquisition and analysis

    Situation

    An employee is leaving the company and unusual logins, transfers or downloads are noticed before their departure.

    Objective

    Determine whether data was viewed, copied, transferred or exfiltrated before the employee left.

    Example activities

    • Scoping the context and the questions to investigate
    • Preservation of the workstation, mailbox and available traces
    • Forensic acquisition of the workstation and collection of relevant logs
    • Analysis of logins, USB devices, messaging, cloud synchronisation and file transfers
    • Timeline reconstruction and report writing
  3. 3 / 5

    Data leak analysis

    Situation

    An internal document is circulating outside the company and its origin is unknown. A data leak is suspected.

    Objective

    Determine whether data has left the company environment, identify the possible exit routes and assess the scope of the information involved.

    Example activities

    • Scoping the context and formulating hypotheses
    • Collection of relevant traces from workstations, mailboxes, cloud environments and security equipment
    • Search for the document or data concerned based on its characteristics, hashes or keywords
    • Analysis of unusual transfers: volumes, times, destinations and channels used
    • Search for indicators of compromise and, where relevant, traces of external exposure
    • Timeline reconstruction, conclusions and recommendations
  4. 4 / 5

    Document integrity analysis

    Situation

    A document shows unusual features and we want to determine whether it has been modified, altered or replaced.

    Objective

    Determine whether a digital document has been modified, when those changes may have occurred and which technical evidence characterises them.

    Example activities

    • Scoping the question and assessing feasibility
    • Collection and preservation of the available versions
    • Analysis of the file's metadata and structure
    • Comparison of versions, contents and technical properties
    • Search for traces of modification, creation, conversion or deletion
    • Timeline reconstruction and drafting of conclusions
  5. 5 / 5

    Audio or video media analysis

    Situation

    An audio recording or a video is presented to us as authentic and we have reason to doubt it.

    Objective

    Look for technical evidence that may reveal modification, generation or manipulation of the media.

    Example activities

    • Scoping the question and assessing feasibility
    • Collection and preservation of the original file
    • Analysis of the structure, metadata and technical characteristics
    • Search for audio, visual or timing inconsistencies
    • Search for traces of editing, re-encoding, transformation or generation
    • Analysis of the available contextual elements
    • Conclusions with the level of confidence and the limits of the analysis

Your situation doesn't fit any of these?

These are the most common investigations, but they don't cover every case. Tell us about your issue and your constraints: we will assess feasibility and point you to the most suitable analysis.

Talk to an expert
Scope

What we can analyse

An investigation is never limited to a single workstation. Traces corroborate each other across machines, the cloud, the network and the files themselves. Explore the environments we cover.

Workstations and servers

The machines on which the data was handled, whether physical or virtual.

WindowsmacOSLinuxVirtual machinesDisk images

Messaging and collaboration

Communications, shares and workspaces, the main source of traces within a company.

Microsoft 365ExchangeGoogle WorkspaceTeamsSharePointOneDrive

Cloud and identities

Logins, permissions and shares: who accessed what, from where and when.

Entra IDAuthentication logsApplication accessExternal shares

Network and security

Logs from your equipment, which record outbound traffic and alerts.

FirewallProxyVPNEDRSIEM

Media and mobile devices

Removable media and business devices, often at the heart of data copying.

USB drivesExternal drivesNASSmartphonesTablets

Documents and media

The files themselves, whose internal structure reveals changes and tampering.

MetadataOffice filesPDFAudioVideo

Our investigations are carried out within a defined legal framework and only on the systems, accounts and data that the mandate authorises us to analyse.

Your environment isn't on this list? Let us know: we will tell you what can technically be analysed before any commitment.

Process

How an engagement works

Six stages, from first contact to the report.

  1. Together we define the questions to be answered, the scope of the engagement and the applicable legal framework. Where needed, we rephrase the questions, always with your agreement, so that the results are relevant and usable.

    At the end of this conversation, we tell you clearly what is technically achievable, where the analysis will reach its limits and what results you can reasonably expect.

  2. We quickly secure workstations, mailboxes and logs to prevent any loss or alteration of data. This step is essential: some digital traces, particularly in the cloud, are only retained for a limited time.

    A restart, a reinstallation or the deletion of a compromised account can permanently destroy elements the analysis needs. Preserving the traces from the outset is what makes the investigation reliable and usable.

  3. We make a forensic copy of the medium without altering the original data. Its integrity is checked and verified by hash, and all analyses are then carried out on the copy.

    This method guarantees the integrity of the evidence and allows a third party to verify and reproduce our findings.

  4. We analyse the traces left by systems and applications to reconstruct events: logins, transfers, deletions, external media, cloud activity...

    Each element is placed in a timeline and linked to its technical source.

  5. We test each finding against the alternative hypotheses, including those that could call it into question.

    This assessment measures the real weight of the technical evidence and avoids hasty conclusions.

  6. We deliver a clear and usable report, including the timeline of events, the technical evidence, our conclusions and recommendations.

    The report separates what is established, what is probable and what cannot be concluded, and we then walk you through it.

Deliverables

You receive a clear, structured and usable report

At the end of the assignment, we deliver a report that brings together the key elements of the investigation:

  • Timeline of events

    The reconstructed, time-stamped events, linked to the technical traces that establish them.

  • Conclusions

    What the data establishes, what it suggests and what it does not allow us to conclude.

  • Recommendations

    The preventive and corrective measures to consider to reduce the risk of recurrence or secure the situation.

  • Support for legal steps

    The technical evidence useful for your insurer, a criminal complaint, a notification or any exchange with a competent authority.

Our guarantees

Why entrust your investigation to SecuLabs

  • A rigorous methodology

    Our investigations rely on recognised methods and frameworks, adapted to the nature and stakes of each case.

  • Preserved and traceable evidence

    Forensic copies, hash verification and chain of custody guarantee the integrity and traceability of the evidence analysed.

  • Strict confidentiality

    Data, sealed items and case materials are kept securely in a safe and are accessible only to authorised staff.

  • Expertise recognised in proceedings

    Our experts work with lawyers, courts and authorities, with reports designed to be understood, discussed and defended.

  • An independent methodology

    No dependence on third-party software: our conclusions rest on the observed data and are verified by several methods where necessary.

  • Clearly established conclusions

    We distinguish what the data demonstrates, what it suggests and what it does not allow us to conclude.

Incident emergency

Is an attack under way?

Forensic investigation establishes the facts after the event. If the compromise is active, the priority is to regain control without destroying the traces. Don't restart or reinstall anything: isolate the machines from the network and call our CSIRT.

Request emergency response
Build the skills

Our training: give your teams the right reflexes

Most evidence disappears in the first few hours, wiped by well-meaning internal teams. Our courses teach them what to do instead.

Forensics · SOC / CSIRTCode: OFD-320Duration: 2 days

Malware Forensics

Run a full forensic investigation around a ransomware case, from the initial intrusion through to the analysis of its impact and the technical artefacts left on the compromised environment.

View the course
InvestigationCode: OFD-210Duration: 1.5 days

OSINT & Digital Investigations

Learn to search, cross-check and analyse open-source information in order to turn digital traces into actionable intelligence.

View the course
GRC · ResilienceCode: GRC-110Duration: 1 day

Business Continuity Management

Anticipate critical disruptions, structure your business continuity and prepare your organisation to maintain or resume operations in the face of a crisis, cyber included.

View the course
See all courses
Frequently asked questions

What companies ask us

Switching a machine off can destroy volatile evidence that is valuable to the investigation. Ideally, isolate it from the network (unplug the internet connection and turn on flight mode) and keep it plugged into a power outlet so the battery does not run down.

Describe your situation

We will tell you what an investigation can establish, what it cannot, and how long it will take.

Request a feasibility assessmentIncident under way?

Confidential conversation, feasibility assessment before any commitment

Legal

Sealed evidence, court-appointed expertise, private expertise and expert report reviews.

Individuals

Compromised device or account, suspicious email, personal data recovery.