Evidence sources
Sign-in logs, mailbox rules, message traces, endpoint alerts, VPN and firewall logs, administrative changes, screenshots, and timestamps.
DIGITAL FORENSICS & INCIDENT RECORDS / 3PSPRESERVE THE EVIDENCE.
PRESERVE THE EVIDENCE.
RECONSTRUCT THE STORY.
3PS brings identity, email, endpoint, cloud, network, and vendor evidence into a scoped investigation of suspected compromise, fraud, insider activity, ransomware, mailbox abuse, or vendor-related exposure. Establish the timeline and affected systems, separating confirmed findings from open questions.
500+ customers served.
Backed by 100+ professionals and technical resources across our delivery network.
Establish the facts before they disappear.
- 01
Identify preservation needs
Establish the devices, accounts, mailboxes, logs, backups, and systems relevant to the incident before uncoordinated changes obscure the evidence.
- 02
Collect the available sources
Review authorized identity, email, endpoint, firewall, DNS, cloud, SaaS, backup, and vendor records. Document missing or unavailable evidence.
- 03
Build the timeline
Correlate the first known signal, access paths, possible movement, changes, containment actions, and recovery steps.
- 04
Assess the affected scope
Review users, systems, data, mailboxes, sessions, files, and third parties confirmed or plausibly affected, preserving that distinction.
- 05
Separate findings from hypotheses
Label confirmed facts, candidate explanations, evidence gaps, and decisions that changed the environment.
- 06
Build the incident record
Document the timeline, evidence, actions, unresolved questions, and next response or improvement priorities.
The first scramble can erase the timeline.
A suspicious mailbox rule appears, a laptop behaves unusually, and several vendors propose resets or rebuilds. Relevant logs and configuration changes need coordinated preservation while the team plans containment.
The investigation record
Known facts, missing evidence, affected scope, authorized containment actions, and the decisions behind the response.
The engagement establishes the work, authority, and acceptance required.
Keep the gaps in the evidence visible.
Changes before preservation
Identify what must be recorded before resets, reinstalls, mailbox cleanup, or policy changes alter the available evidence.
Expired or incomplete logs
Prioritize volatile records and document retention limits, unavailable sources, and the effect on the investigation.
A single-console explanation
Correlate identity, email, endpoint, cloud, network, and backup evidence instead of treating one tool as the complete incident history.
Conflicting recollections
Build a timeline and decision record that leadership, vendors, insurers, and counsel can review as appropriate.
THE WORK IN MOTION
Connect the evidence to authorized action.
Make the incident record usable.
Timeline
Observed events, timestamps, relevant changes, movement supported by evidence, and containment or recovery actions.
Scope of review
Users, devices, mailboxes, systems, data, vendors, and cloud resources reviewed, including the limits of the investigation.
Evidence inventory
Logs, screenshots, exports, alerts, support records, hashes, URLs, domains, and other relevant artifacts available within the scope.
Action record
Authorized changes such as session revocation, host isolation, rule removal, indicator blocking, and restore validation, with their evidence and outcomes.
Residual questions and risk
What remains unknown, the additional evidence or monitoring needed, and the next improvement priorities.
When litigation-grade evidence handling is required, 3PS coordinates with counsel and licensed examiners. Preservation, access, collection methods, handling requirements, and the intended use of the record are established for the engagement.
Prepare the sources before the next investigation.
Evidence readiness
Document logging, retention, tenant audit, endpoint visibility, firewall history, backup evidence, and vendor access.
Environment knowledge
Continuing work can maintain contacts, evidence requirements, operating records, and incident responsibilities.
Public first signals
Exposure and tool checks can review attack-surface, breach exposure, Microsoft 365 posture inputs, reputation, TLS, uptime, and security headers. Public signals do not replace an authorized internal investigation.
Examples of continuing work. The agreement defines covered systems, deliverables, resources, working hours, reporting, and response commitments. Hardware, software, dedicated resources, and projects are included only when stated; Critical Response is separately priced.
LET’S DEFINE
THE NEXT MOVE.
Bring the objective, the environment, and what needs to change. We will connect the right disciplines around a defined engagement.
DISCUSS AN EVIDENCE REVIEW