Ransomware at 2:14 AM. A wire that left at 4:47 PM for a vendor you’ve never heard of. A departing engineer’s laptop with customer data that shouldn’t have been there. The difference between a quarter-ending footnote and a quarter-ending disaster is the first six hours — and whether the people on the bridge know what they’re doing. Our DFIR hotline is tied directly to the same Memphis command center that runs physical response. One command. One timeline. One written record at the end.
Digital Forensics and Incident Response isn’t one thing. It’s the discipline of running a cyber crisis the same way a fire marshal runs a structure fire — containment first, preservation in parallel, investigation on a timeline, written record at the end. Four problems, one integrated response.
By the time you see the ransom note, the adversary has typically been inside for 8–21 days. Backups are often already compromised. Domain controllers are usually encrypted. Recovery without a clear containment plan leads to reinfection inside a week. We run containment, coordinate the negotiation-vendor handoff if it comes to that, and preserve the forensic record your insurer, counsel, and possibly the FBI will want later.
Business Email Compromise costs US businesses more than ransomware every year — and the recovery rate on a fraudulent wire drops sharply after the first 72 hours. FinCEN’s Rapid Response Program and the FBI’s IC3 Financial Fraud Kill Chain both depend on speed. We run the parallel bank-recall, IC3, and forensic-investigation workstreams from the first call.
Departing-employee data theft, privileged-user abuse, fraud by staff — every insider investigation ends up in arbitration, employment litigation, or a settlement. That means chain-of-custody matters from the first minute. We scope the preservation plan with your counsel before collection starts, image the systems, and produce an examiner report suitable for a court exhibit.
HIPAA’s 60-day clock starts at discovery, not containment. 48 states have breach-notification laws with their own windows, their own AG-notification thresholds, their own consumer-letter content rules. GLBA’s revised Safeguards Rule added a 30-day FTC notification window. Your breach coach drives the letters; we drive the forensic record the letters are built on.
Every incident we accept runs the same four-stage protocol, timestamped by our Memphis command center and logged to your matter file. The cadence mirrors our physical-security alarm-response protocol deliberately — same dispatch, same clock discipline, same written-report finish — because when the cyber and physical sides both hand you a single timeline at the end of the week, your board and your insurer are looking at one story, not two.
Live dispatcher answers the DFIR hotline at our Memphis command center in an average 2.1 rings, 24/7/365. The dispatcher takes structured intake — caller, organization, contact path, apparent incident type — and pages the on-call senior responder. For retainer clients, your named responder is on a bridge and scoping within 45 minutes of the intake call; on-call engagements are best-effort on the same pickup but without the guaranteed triage SLA. Every inbound call is recorded and timestamped.
Within 45 minutes the on-call senior responder is on a secure bridge with you, your IT lead, and — if you have one — your cyber-insurance breach coach and panel counsel. Scope is established in writing before any containment action: what systems are in scope, what preservation is needed, what counsel has authorized, what the insurer’s approved-vendor position is. If a written engagement letter doesn’t exist yet for on-call clients, it gets emailed and e-signed on the bridge. No billable forensic work happens without authority on record.
Within four hours of engagement, containment actions are underway — network segmentation, credential rotation, endpoint isolation, blocking known indicators, pulling the compromised mailbox session, whatever the event requires. Preservation runs in parallel with containment, not after it: memory captures on affected systems before power cycles, forensic images before rebuilds, log exports before retention windows close. Remote collection where possible; a responder physically dispatched to any TN or MS site inside the same business day where on-site collection is required.
By hour 24, you have a written factual brief — what we know, what we don’t, what we’re still collecting, where the evidence points. By hour 72, a preliminary examiner report with methodology, artifact list, chain-of-custody log, hash verifications, initial findings, and open questions. Written so your breach coach can calendar notification deadlines and your insurer can scope reserves. The final examiner report follows engagement close, signed under penalty of perjury, suitable for a litigation exhibit if the matter travels.
DFIR as a category is broad. These are the four scenarios we accept engagements on, the tooling we use, the breach-notification regimes we coordinate around, and the cyber-insurance panel work we’re built to integrate with.
We scope to what we can do well. If an engagement falls outside our competence — nation-state APT hunt requiring classified-intel access, industrial-control-system event requiring vendor-specific SME — we say so on the triage call and refer, rather than learn on your dime.
Industry-standard tooling, court-accepted methodology, version-pinned workstation builds, and written chain-of-custody from the first acquisition forward. Every artifact we produce is built to travel to deposition.
We don’t practice law and we don’t file breach-notification letters. What we do produce is the forensic record your breach coach needs to calendar the right deadlines — affected-individual counts, data categories, dwell time, evidence of exfiltration versus mere access — in the format counsel uses to drive the statutory clock.
Cyber policies almost always require the carrier to approve the IR vendor before covered costs start accruing. Pick the wrong firm first and the claim is denied. We coordinate with your breach coach from Stage 02 onward so the engagement tracks cleanly against the policy.
We offer two engagement models on the same hotline, staffed by the same responders. Retainer clients get a guaranteed triage SLA, a reduced hourly rate, a pre-executed master services agreement, and prepaid hours that draw down against the retainer. On-call clients pay standard rate, sign the MSA at call time, and wait in queue behind retainer engagements when the hotline is busy. Most mid-sized organizations with cyber insurance carry a retainer because the insurer’s policy often requires a pre-engaged IR vendor to begin with — and because the MSA negotiation at 3 AM is not where you want to lose the first four hours.
Annual retainer with a bank of prepaid hours. Triage SLA of 45 minutes from hotline intake to senior responder on a bridge. Containment kickoff within four hours of engagement. Pre-executed master services agreement and counsel-led work-product protection framework. Reduced hourly rate against the retainer bank; unused hours convert to tabletop exercises, purple-team engagements, or roll forward one quarter.
Same hotline, same responders, no retainer in place. MSA is negotiated and e-signed on the triage bridge; forensic work starts after authority is on record. Best-effort response — no guaranteed triage SLA — and the hourly rate is standard DFIR market. Appropriate for organizations without cyber insurance requiring a pre-engaged vendor, or for single-incident engagements outside the retainer scope you already carry with another firm.
The questions we get most on RFPs, counsel-led breach-readiness calls, and the first five minutes of a triage bridge — answered specifically, not generically. If yours isn’t here, call the DFIR hotline at (202) 222-2225 and we’ll answer it on the spot.
A senior responder will walk through your environment, your cyber-insurance posture, and your breach-notification obligations, then deliver a retainer proposal scoped to your risk inside five business days. No cost. No pitch. If you’re in the middle of an incident right now — call the hotline. The retainer conversation happens later.
