INVESTIGATION AND DIGITAL FORENSICS
When a decision depends on digital facts, method matters
forense.io conducts collection and analysis with traceability, chain of custody and documentation suited to the purpose of the investigation.
HOW DO YOU GET TO THE FACTS?
A method in four stages
Every stage documented, so the result can be verified.
Collection and preservation record
Item 03 · corporate laptop
- Media
- 512 GB SSD, serial number recorded
- Method
- Bit-by-bit forensic image, with write blocker
- Handled by
- C. Souza
- Start
- Sep 12, 2026 09:12 BRT
- Witness
- A. User, nClient representative
SHA-256 · SOURCE AND COPY
9c4e1a07b52df3e86a10c9f4d27b5e03a8f61c2d94e7b0a35f8c16e2d40b97a1
Verified: source and copy are identical
Analysis questions
Drafted with legal counsel before the examination
- Q1Was the finance repository accessed between Sep 1 and Sep 10, 2026?Under examination
- Q2From which accounts and devices?Under examination
- Q3Were files copied or sent outside the environment?To be examined
- Q4Do the available records allow an answer, and with what limitation?To be examined
Correlated timeline
Sep 3, 2026 · BRT time · four sources
| TIME | SOURCE | EVENT |
|---|---|---|
| 18:42 | VPN | Account usr-0421 connects from an external address |
| 18:47 | File server | Access to the finance repository |
| 18:55 | Workstation (item 03) | 312 files compressed |
| 19:03 | Proxy | 1.2 GB uploaded to an external storage service |
Forensic report · question Q3
Each statement with its degree of certainty
- OBSERVATION
- The proxy logs a 1.2 GB upload at 19:03 from item 03.
- HYPOTHESIS
- The uploaded file is the package compressed at 18:55.
- CONCLUSION
- Size and time are consistent with the hypothesis.
- LIMITATION
- The uploaded content could not be verified: the external service was not examined.
HOW DO WE WORK?
Precision, discretion and integrity
A company of the NESS ecosystem, since 2022.
- 01Facts before narrativesWe start from artifacts and formulated questions. We don't promise the desired answer.
- 02Chain of custodyPreservation, integrity and traceability support the use of the work.
- 03Legal and complianceWe connect technique, expert questions and limitations, without replacing legal advice.
- 04Relationship with incidentsCoordinated work with n.cirt, balancing preservation and recovery.
AND WHEN YOU NEED TO GO FURTHER?
Operations, governance and forensics in the same ecosystem.
When operations call for an audit or an investigation, the NESS brands work together, with no change of provider.
Technology operations and security: n.infraops, n.secops, n.devarch, n.autoops, n.cirt and ness.OS.Learn more →
Governance, risk, compliance and privacy, from assessment to ongoing tracking in n.360.Learn more →
Digital forensics and investigation, with chain of custody and a technical forensic report.
WHERE DO I START?
Structure the investigation
Describe the situation without sending files or artifacts. A forensic specialist will reply to the email you provide.