Home / Services / Incident Response
Service 06 ยท Forensics and Incident Response
Suspect a breach? Call (801) 947-7111.
Breach investigation and incident management led by an EnCE-certified examiner. We contain the threat, find out what happened, preserve the evidence and harden your environment afterward.
Your first five minutes matter.
These steps preserve evidence and limit the damage while we get to work.
- 01
Disconnect from the network
Unplug the network cable or turn off Wi-Fi on affected systems.
- 02
Don't power off or reboot
Memory holds evidence that is lost when a system shuts down.
- 03
Don't clean up
Avoid deleting files, running cleanup tools or reinstalling software.
- 04
Write down what you saw
Note messages, times and who noticed what.
- 05
Call us and check your insurance
Many cyber insurance policies require prompt notice and may specify approved responders.
What we do
- Incident management and containment
- Breach investigation and root cause analysis
- Digital forensics on computers and servers
- Network forensics from firewall and log data
- Mobile device forensics
- Microsoft 365 and business email compromise investigation
- Recovery and hardening
How we handle it
- Led by an EnCE (EnCase Certified Examiner)
- Evidence preserved with documented chain of custody
- Forensic imaging before analysis
- Findings documented for leadership, insurers and legal counsel
- Lessons learned built back into your security standard
Answers you can rely on, not guesses.
After an incident, leadership needs to know what happened, what was accessed and whether it's over. Insurers, attorneys and sometimes regulators will ask the same questions. Those answers have to hold up.
Our investigations follow forensic practice. We image affected systems before analyzing them, preserve evidence with a documented chain of custody, and reconstruct events from endpoint, network, firewall and Microsoft 365 logs. The result is a written report that explains the cause, the impact and the timeline in plain language.
Once the incident is contained, we fix the root cause and close the gaps that allowed it, using the same standard every Strong Connexions client runs on.
Why forensics shapes everything we build
Investigating real incidents shows us how attackers get in. That experience is built into the standard every client runs on.
Stop the spread
Isolate affected systems and accounts quickly.
Find the cause
Determine how they got in, what they touched and when.
Close the door
Fix the root cause so it doesn't happen again.
Common questions
What is an EnCE?
EnCE stands for EnCase Certified Examiner, a digital forensics certification that requires training, a written exam and a practical examination.
Should we call our insurer first?
Check your policy. Many cyber insurance policies require prompt notice and may specify approved responders. Calling both early is the safest path.
Can you investigate a compromised Microsoft 365 mailbox?
Yes. Business email compromise is one of the most common incidents we investigate. Read what a BEC investigation involves.
Do you work with attorneys?
Yes. Findings are documented so leadership, insurers and legal counsel can rely on them, and evidence is preserved with chain of custody.
Do you help non-clients?
Yes. Call the urgent line at (801) 947-7111 whether or not you are a current client.
The rest of the standard
Every service is secured the same way, so they work better together.
Prepare before you need us.
An incident response plan and a tested backup make every incident smaller. We can help you build both.