Digital Forensics

Network Forensics

Investigation of network activity, logs and traffic to establish what happened.

We examine network evidence (firewall and router logs, traffic captures, authentication records and connected devices) to reconstruct events, identify unauthorised activity and support incident response for home and office environments.

Who it’s for

Businesses responding to suspicious network activity
IT managers needing an independent investigation
Home users concerned about unauthorised access

What we examine

Firewall, router and server logs
Packet captures and flow data, where available
Wi-Fi and connected-device inventories
Remote-access and authentication records

How an engagement works

Triage

We establish what happened, when it was noticed and what has changed since.

Evidence collection

Available logs and captures are preserved before they rotate or are overwritten.

Analysis

Activity is correlated into a timeline of events.

Report and recommendations

Findings plus practical steps to contain and secure the environment.

What you need

Administrative access to, or the co-operation of, whoever manages the network
Logs retained for the period in question

What you receive

Event timeline
Findings report
Containment and hardening recommendations

Limitations. Network forensics can only use the evidence that exists. Where logging was disabled or has rotated, conclusions may be limited.

Please don’t upload evidence or send passwords through this website. Once we’ve discussed your matter, we’ll arrange a secure handover with a documented chain of custody. How evidence is handled.

Questions

Should I switch everything off?

Not necessarily: switching off can destroy volatile evidence. Contact us first; if there is an active threat, disconnecting affected devices from the internet is usually safer than powering them down.