Digital forensics that states what the evidence shows.
F Creative Studio 360 preserves and examines systems for organisations in any country, and writes a report counsel can use.
The questions after an incident are factual.
How did they get in, what was touched, and is it still happening. The method is consistent with NIST SP 800-61. Cloud and mail artefacts are read from the platforms in scope, such as Microsoft 365, Google Workspace, AWS, Microsoft Azure and Google Cloud.
- A record counsel can use
- The investigation preserves evidence and writes what the evidence shows. How that record is used in a notice, a claim or a court is your counsel’s decision.
- Attribution is not a promise
- F Creative Studio 360 states a cause where the artefacts support it. Where they do not, the report says so.
- Testimony is separate
- A briefing for counsel can be in scope. Appearing as a witness is a further agreement, and only where a proceeding actually requires it.
- This is not containment by itself
- If the incident is still active, incident response comes first. Forensics starts once there is authority to preserve and examine.
What can be examined
Only the systems and accounts the organisation authorises. The same discipline works in any country.
- A breach
- How access was gained, what was touched, and whether data left, as far as the images and logs show.
- An insider question
- A timeline of account and file activity for a named person or system, kept discreet and limited to the authority you gave.
- Ransomware
- What the malware did and how it arrived. Recovery uses the organisation’s own backups. Decryption is not offered.
- Cloud and email
- Identity, mailbox and cloud audit logs where those platforms are in scope, including Microsoft 365, Google Workspace, AWS, Microsoft Azure and Google Cloud.
- Disk, memory and logs
- Images and logs handled so a later reader can see the chain of custody. The report does not include a recipe for breaking into a system.
- A report
- Findings, a timeline and the limits of what was examined. F Creative Studio 360 does not file it with a regulator.
How an investigation runs
Preservation comes before analysis. A live incident is contained under the incident response engagement first.
- 1
Confirm authority
Who may authorise collection, and which systems, accounts and countries are in scope.
- 2
Preserve
Take what is volatile first, and record the chain of custody.
- 3
Examine
Rebuild the timeline from the artefacts. Do not claim a fact the artefacts do not support.
- 4
Report
A document for management and counsel. Any notice or claim stays with them.
What you receive
- A chain-of-custody note for what was collected.
- A timeline limited to the evidence examined.
- An impact statement that separates fact from what is still unknown.
- A briefing for counsel, when that was in scope.
- No filing, and no claim that the environment is now certified safe.
Common questions
What is a digital forensics investigation?+
A structured examination of systems, accounts and logs after an incident or a suspected misuse, written so the findings can be shown to counsel. F Creative Studio 360 does not decide the legal consequence.
Will you report the breach for us?+
No. The report says what the evidence shows and when. Counsel decides whether the Notifiable Data Breaches scheme, GDPR or another rule requires a notice, and counsel files it.
Can you help with an insurance claim?+
The technical report can be given to the insurer if you instruct that. F Creative Studio 360 does not advise on the policy and does not conduct the claim.
Where do you do this?+
For organisations in any country, remotely or on site. Collection follows the authority and the privacy rules that apply to those systems.
How much does it cost?+
It depends on how many systems must be preserved and how far the timeline has to go. A scoping conversation with F Creative Studio 360 is the way to get a quote. There is no obligation to proceed.
Start with what must be preserved.
F Creative Studio 360 will confirm authority and the systems in scope, then say what the investigation can cover.