Digital forensics for technical investigations and evidence-led decisions.
Osiris supports your organisation with forensic investigation, evidence preservation, technical analysis, and post-incident understanding. Defensible at tribunal and useful at board level.
Forensic capability that survives a tribunal.
Eight capabilities that turn a chaotic event into a clear written narrative your insurer, your counsel, and your board can act on.
Understand what happened
Where the compromise started, how it moved, what it touched, and how long it had access. We reconstruct the narrative from the evidence.
Preserve evidence properly
Forensic imaging, chain-of-custody documentation, and write-blockers so the evidence holds up later with insurers, regulators, or a tribunal.
Investigate devices, accounts, and systems
Endpoint forensics, cloud and identity analysis, email forensics, USB and removable-media review, across Windows, macOS, mobile, and Microsoft 365.
Support incident response and remediation
We can run alongside an active incident or work after the fact, with findings feeding straight back into containment, recovery, and the rebuild plan.
Document findings clearly
A written report your insurer, your board, and your counsel can act on. Plain language for the leadership team, technical appendices for the specialists.
Improve controls after investigation
Every investigation ends with a mapped control gap, a remediation plan, and a tabletop test scheduled to verify the gap stays closed.
Timeline reconstruction
A clear sequence of events from initial access to containment, built from logs, artefacts, identity activity, and user actions.
Insurer and counsel support
Findings shaped for the people who need to rely on them, including cyber insurers, legal counsel, HR teams, and senior leadership.
The report is the deliverable. Everything else is the work that makes it defensible.
A good forensic report is short, written in plain language, and answers the question your board, your insurer, and your counsel are actually asking. Everything underneath it, the imaging, the chain of custody, the technical analysis, exists to make that report hold up under scrutiny. We do the underneath properly so the report can stand on its own.
Don't fill the form. Call us.
If systems are compromised or you've seen suspicious activity, time matters. Talk to a senior consultant straight away, on the phone, before anything else.
Need an investigation that holds up later?
Whether it's an active incident, a suspected leak, or an insurer or tribunal-driven review, talk to a senior consultant about scope, methodology, and what a defensible report would look like for you.