Digital forensics & incident response

Do not power the machines off and do not rebuild them: volatile memory and logs often hold most of what will explain the incident. Isolate from the network rather than shut down, preserve logs before they roll over, note the time and nature of every action taken, and move internal communication to a channel known not to be compromised. Then call. The decisions of the first hour shape everything that follows.

Yes. The emergency number on this page is open, and an initial assessment is done by phone to gauge the situation and the immediate steps. Contracting follows, it does not come first. That said, a retainer prepared in calm conditions — scope known, contacts identified, access arranged — buys back the hours that matter most.

That is what the chain of custody is for: every item is collected, hashed, sealed and traced, so that it can be shown not to have been altered between collection and analysis. We work that way by default, even when no complaint is being considered — the decision to take the matter further often comes later. Admissibility is then for the authority seized of the case and your legal counsel; our part is not to compromise it.