C3SA's CyberFIRE team investigates breaches, insider cases and suspected compromise using forensically sound methods, from evidence acquisition to findings that can be defended in court.
Investigate insider misconduct, fraud and policy violations on workstations, laptops and servers.
Recover and document evidence from smartphones and tablets.
Reconstruct network-based attacks from logs, security events and packet captures.
Identify the attack vector, malware, lateral movement and stolen data.
Find, preserve and recover relevant data for litigation or investigation.
Baseline devices before high-risk travel and check them for tampering afterwards.
Every investigation starts with written authorization and an agreed scope, and every piece of evidence is tracked from acquisition to report.
Employee misuse, fraud and malicious insiders can cost an organization its data, its reputation and its legal position. C3SA examines workstations, laptops and servers to uncover and document what happened, using a process built to withstand legal scrutiny if the matter goes to court.
What you get
Phones and tablets now hold as much sensitive information as laptops, and are just as often involved in wrongdoing or compromise. C3SA analyzes mobile devices to recover and document artefacts such as messages, application data, location history and signs of malicious apps.
What you get
Using the safeguards you already run, such as firewalls, intrusion detection and SIEM, C3SA reviews captured security events, logs and packet captures to establish how an attacker got in, what they reached and where data went. See Security Operations.
What you get
When a compromise is suspected, the questions are urgent: how did they get in, what did they install, where did they move and what did they take? C3SA uses memory analysis and reverse engineering to find malware that never touches the disk, determine what it does and produce indicators of compromise your team can hunt for. See CyberFIRE Incident Response.
What you get
When litigation or a formal investigation begins, most organizations lack the skills to find and preserve relevant files and metadata. C3SA identifies relevant data in large datasets, preserves it so it cannot be modified, and transfers it securely to your counsel or investigators. The same capability recovers data from damaged or corrupted drives, deleted files and systems locked by forgotten passwords or deliberate encryption.
What you get
Laptops and phones taken to countries with aggressive intelligence services can be searched or implanted while connected to untrusted networks or left unattended. C3SA creates a forensic baseline of each device before departure and analyzes it on return to detect unauthorized changes or access. Baselines of servers and workstations also make it faster to spot compromise later. See Executive Protection.
What you get
Findings are only useful if they survive challenge. Every C3SA investigation follows a repeatable, auditable process aligned with recognized forensic standards.
Many CyberFIRE investigators come from the Canadian military and intelligence community, where they defended some of the country's most sensitive networks against sophisticated, persistent threat actors. They bring that discipline to corporate investigations, insider cases and litigation support.
Because the same team handles incident response, forensics is built into containment from the first hour, so evidence is preserved rather than lost when systems are rebuilt.
Disconnect affected systems from the network rather than powering them off, so evidence in memory is preserved. Do not wipe, reimage or run cleanup tools, and write down what you saw and when.
No. Much of the work involves insider misconduct, fraud, policy violations, departing employees and litigation, where no external attacker is involved.
Investigations follow a documented chain of custody and validated methods so that findings can be relied on in legal, regulatory or HR proceedings. Your counsel should guide how the investigation is directed, particularly where privilege matters.
Often, yes. Many acquisitions and analyses can be performed remotely and securely. Some cases, such as damaged hardware or mobile devices, need the device in hand.
An organization needs to know what happened, who was involved and what was affected, with evidence it can rely on.
C3SA's CyberFIRE investigators acquire and preserve evidence, analyze systems, devices and networks, and explain their findings in plain language.
Preserved evidence, a defensible findings report, indicators of compromise and recommendations to prevent a repeat.
