ARCHERY ITCyber Incident Investigation
Investigation and response support after a breach, compromise or attack.
When something has gone wrong, such as a compromised account, ransomware, data leak or unexplained access, we help establish the facts: what happened, how, what was affected and what to do next. Our work combines network, computer and cloud forensics with practical containment advice.
Who it’s for
- Businesses responding to a suspected breach
- Organisations needing an independent account of an incident
- Insurers and legal advisors
What we examine
- Affected endpoints and servers
- Network and cloud activity logs
- E-mail and account compromise
- Data-exposure assessment
How an engagement works
Immediate triage
We establish what is happening and advise on containment that preserves evidence.
Evidence preservation
Logs, images and volatile data are captured.
Investigation
Root cause, timeline and scope of impact.
Report and recovery guidance
Findings, lessons learned and hardening recommendations.
What you need
- A point of contact with authority over the affected systems
- Access to the affected systems and logs
What you receive
- Incident timeline
- Investigation report
- Recommendations to prevent recurrence
Limitations. Response times and availability are confirmed when you contact us. Investigation results depend on the evidence still available.
Please don’t upload evidence or send passwords through this website. Once we’ve discussed your matter, we’ll arrange a secure handover with a documented chain of custody. How evidence is handled.
Questions
We think we are under attack right now. What should we do?
Call or WhatsApp us immediately. Avoid wiping or rebuilding systems before evidence is preserved, unless that is needed to stop active harm.