That's right... We can help you take a forensic approach to Incident Response.
Why? Because we have the ability to preserve the evidence should you decide to take legal action at a later date. We also perform "live forensics" against Windows-based servers.
If you have experienced a computer breach, contact us at (416) 788-9640, before accessing the system in question.
Most IT departments must meet a certain level of performance and cannot afford to have a server off-line for any extended periods of time. The forensic-imaging of a single hard drive could take a full work day or more and that is assuming that the server can be shutdown. Most servers have multiple hard drives, which mean that the traditional method of computer forensics may not be a viable option for you.
In order for you to meet your Service Level Agreement (SLA), CENCOM has created a process that will gather as much information from the compromised system(s) as possible, while the server is still running.
"The past and the present are within the field of my inquiry, but what a man may do in the future is a hard question to answer."
