Digital Forensics and Breach Response, Built for Court
DFE-led investigations for data breaches, ransomware, business email compromise, crypto theft, and BYOD device incidents. Chain-of-custody discipline, validated tooling, and findings that survive cross-examination - delivered from a Raleigh, NC lab that has supported law firms, insurers, and regulated businesses since 2002.
What We Actually Investigate
Petronella Technology Group runs a focused digital forensics practice. We do incident response, breach forensics, and network-side investigation work that holds up in court. We do not compete with full-spectrum lab houses on consumer-device imaging. Below is the honest list - what we deliver, and what we refer out.
Digital forensics is the scientific process of identifying, preserving, analyzing, and presenting electronic evidence in a manner that is legally admissible and technically defensible. Every modern legal dispute and security incident involves digital evidence - emails, server logs, packet captures, cloud-account activity, browser history, financial records, ransomware notes, on-chain transactions, and the artifacts that operating systems write to disk without users ever knowing. The question is not whether digital evidence exists, but whether it can be collected, analyzed, and presented in a way that courts, regulators, and cyber insurance carriers will accept.
Petronella focuses where our credentialed bench is strongest: incident response for active and post-breach environments, network and server forensics for breach timeline reconstruction, malware reverse-engineering for ransomware and persistence-mechanism analysis, cloud-account compromise investigation across Microsoft 365 and Google Workspace, crypto forensics for theft, pig butchering, and SIM-swap-enabled fraud, BYOD breach response on corporate-owned and managed mobile devices, and expert testimony for matters our team has personally worked. Our forensic posture is conservative by design - we collect and document what is defensible, and we say so explicitly when a request falls outside our credentialed scope.
When a matter requires services we do not offer in-house (consumer iPhone extraction, traditional large-firm e-discovery with Relativity or Everlaw, custody-litigation phone imaging, licensed private investigation), we refer to vetted partners. That referral discipline is part of why our findings hold up - we do not stretch our credential to cover work our toolchain was not built for. Honest scope is admissible scope.
What We Do, and What We Do Not Do
The clearest way to tell a credible forensic firm from a marketing-driven one is whether they tell you, upfront, what they do not offer. Here is our line.
What We Do
Active scope - work our DFE-credentialed team performs directly, with chain-of-custody artifacts.
- Breach response on corporate-owned and BYOD-managed devices
- Network forensics: packet capture, NetFlow, firewall, DNS, proxy
- Server-side log analysis (Windows, Linux, hypervisor, container)
- Malware reverse-engineering, persistence-mechanism analysis
- Ransomware response, decryption-feasibility analysis, recovery
- Email and cloud-account compromise investigation (M365, Google Workspace)
- Business Email Compromise (BEC) wire-fraud investigation
- Crypto forensics, wallet tracing, on-chain analysis, SIM-swap response
- Incident-response writeups for cyber insurance and regulators
- Expert witness testimony on matters our team personally investigated
What We Do Not Do
Explicit out-of-scope - we refer to vetted partners. Asking us to attempt these would compromise admissibility.
- No Cellebrite (UFED) full-physical mobile extraction
- No EnCase, Graykey, or other consumer-device forensic imaging
- No iPhone or iPad jailbreaking or forensic imaging
- No consumer mobile-device extraction work
- No private investigation work (we are not a licensed PI firm)
- No surveillance, process service, or skip-trace work
- No custody, divorce, or family-law device forensics
- No criminal-defense expert-witness work outside our specialty
- No traditional large-firm e-discovery on Relativity or Everlaw
- No work we cannot personally defend on the stand
If your matter sits in the "We Do Not Do" column, we will tell you immediately and route you to a partner whose tooling fits. Our refusal to overstep is a feature, not a limitation.
Triage, Investigate, Remediate
Three operating phases. Every engagement runs the same arc - what changes is the depth of each phase based on case scope, evidence volume, and downstream audience (judge, jury, regulator, insurer, internal HR).
Preserve and Scope
The first 24 hours decide whether evidence survives. We isolate affected systems, capture volatile state, and freeze evidence before normal IT habits destroy it.
- Volatile-memory and running-process capture
- Forensic imaging with write-blocking hardware
- MD5 and SHA-256 hash baselining
- Chain-of-custody documentation opened
- Network-segment isolation, not blanket shutdown
- Scope interview with counsel, insurer, and IT leads
Analyze and Correlate
We work on forensic copies, never originals. Analysis runs across hosts, logs, network capture, cloud-tenant audit data, and on-chain transactions where applicable. Findings are correlated, not asserted.
- Timeline reconstruction across host and network sources
- Persistence-mechanism and malware analysis
- Lateral-movement and privilege-escalation tracing
- Data-exfiltration path identification (volume, route, destination)
- Cloud-tenant unified-audit-log analysis (M365, Google Workspace)
- On-chain wallet tracing for crypto-loss matters
Report and Restore
Every investigation produces two written artifacts: a technical findings report and a plain-language executive summary. Where downstream action is required (regulator notification, insurance claim, litigation hold, hardening plan), we produce the supporting work product.
- Technical findings report - methodology, tools, results
- Executive summary written for non-technical audiences
- Daubert-ready expert declaration if testimony is needed
- Breach-notification evidence pack for state and federal rules
- Hardening recommendations tied to cybersecurity remediation
- Optional penetration test to validate fixes
In-House IT Response vs Petronella Forensics
Most organizations try to handle the first hour of an incident with their internal IT team. Sometimes that is the right call. Often it is the moment evidence is destroyed. Use this matrix to decide who picks up the phone.
Our Forensic Services in Depth
Each specialty links to a dedicated spoke page with deeper technical detail, sample deliverables, and common-question coverage.
Network Forensics
Packet capture analysis, NetFlow telemetry parsing, firewall and DNS-log correlation, and proxy-log analysis to reconstruct attack timelines and exfiltration paths. Network forensics is decisive in breach matters where the question is not what an attacker touched, but what they took, when they took it, and where it went. We correlate captured network traffic against host-side artifacts and XDR telemetry to build defensible attack narratives.
Crypto Forensics and Theft Recovery
Wallet tracing, on-chain transaction analysis, SIM-swap incident response, pig-butchering scam recovery, and romance-scam wallet investigation. We work the on-chain side of crypto theft - identifying the destination wallets, exchange chokepoints, and mixer hops that determine whether a recovery effort is feasible. Where appropriate we coordinate with law enforcement, exchanges, and counsel to support seizure orders and civil action.
Ransomware Response and Recovery
From the first ransom note through full restoration. We identify the ransomware family, evaluate decryption feasibility, recover what is recoverable from clean backups or shadow copies, and document the entire incident for insurer and regulator deliverables. We do not recommend paying ransom as a first option - our work focuses on whether your environment can recover without it, and how to harden against the next attempt. See our cybersecurity and managed XDR services for the prevention layer.
Business Email Compromise and Cloud-Account Forensics
BEC wire-fraud investigation is one of the highest-volume engagement types we see. We pull Microsoft 365 Unified Audit Log data, parse Entra ID sign-in logs, identify malicious mailbox rules and OAuth grants, and trace the lateral steps an attacker took inside a tenant. Same playbook applies to Google Workspace tenants. Our findings have supported insurance claims, FBI IC3 reports, and civil action.
Server and Disk Forensics
Recovery and analysis of evidence from Windows, Linux, and hypervisor hosts. We examine file systems, registry artifacts, journal data, application logs, container layers, and deleted-but-recoverable structures. Forensic imaging creates bit-for-bit copies with write-blocking hardware, ensuring original evidence remains unaltered. We recover files users believed were permanently deleted and reconstruct activity timelines from sources most general-purpose IT tools cannot see.
BYOD Mobile Breach Response
Scoped exactly: when a corporate-owned or BYOD-managed phone or tablet is implicated in a confirmed breach, we work the corporate side of the incident - MDM logs, conditional-access records, mailbox sync history, and Mobile Application Management telemetry. We do not perform full-physical mobile extraction or consumer-device imaging - that work requires Cellebrite or Graykey toolchains we do not run. If your matter needs deep mobile imaging, we refer to a vetted lab.
HIPAA Breach Forensics
For covered entities and business associates facing a suspected breach of protected health information, we run the forensic determination of whether a reportable breach occurred under the HIPAA Breach Notification Rule, identify the records and systems involved, and produce the OCR-ready documentation pack. We coordinate with HIPAA counsel on the notification clock and risk-assessment framework.
Expert Witness Testimony
Craig Petronella (DFE #604180) provides expert witness testimony in NC state courts, federal courts, arbitration, and depositions. We accept testimony engagements only on matters our team personally investigated. We translate technical findings into clear, well-supported narratives that judges, juries, and opposing counsel can engage with. Testimony availability covers the same scope as the rest of our practice: breach causation, network forensics, BEC, ransomware, crypto theft, and IP misappropriation by digital channel.
Chain of Custody and Legal Admissibility
Digital evidence is only as valuable as the process used to collect and handle it. Our discipline produces evidence that is admissible in NC state court, federal court, arbitration, and regulatory proceedings.
Evidence Integrity
- Write-blocking hardware prevents any modification to original evidence during imaging
- Dual hash verification (MD5 + SHA-256) computed at collection and verified before every subsequent analysis session
- All analysis performed on forensic copies, never on original media
- Original devices stored in tamper-evident evidence bags inside an access-controlled facility with logged entry
- Volatile evidence (memory, process tables, network connections) captured before host shutdown wherever feasible
Documentation Standards
- Continuous chain-of-custody log records every person who handles evidence, with timestamps and purpose
- Methodology documentation meets NC Rules of Evidence, Federal Rules of Evidence, and Daubert admissibility standards
- Tool-validation records demonstrate that forensic software produces accurate and repeatable results
- Reports structured for Daubert and Frye admissibility challenges - methodology, error rates, peer-acceptance, and qualifications all addressed
- Two deliverables per engagement: technical findings report and plain-language executive summary
Matters We Routinely Investigate
Engagement categories we accept. If your matter does not appear here, contact us - we will tell you within one call whether it fits our scope or whether a partner referral makes more sense.
Bench, Credentials, and Public Footprint
Digital forensics is not a technology problem. It is a discipline problem. Every investigation we conduct is performed to the same standard we would defend under cross-examination - because, often enough, we do.
Craig Petronella - Founder, Petronella Technology Group. Licensed Digital Forensic Examiner (DFE #604180) with 24+ years of cybersecurity and digital-investigation experience. Craig has provided expert witness testimony in NC state courts, federal courts, and arbitration proceedings on matters including data breach causation, intellectual property theft by digital channel, employee misconduct, and the authenticity of electronic evidence.
Craig's additional credentials include CMMC-RP (Registered Practitioner), CCNA (Cisco Certified Network Associate), and CWNE (Certified Wireless Network Expert) - a breadth that allows him to investigate incidents that span network infrastructure, wireless systems, cloud tenants, and compliance frameworks (CMMC, HIPAA, NIST, DFARS). His public footprint includes the Forensic Resources of NC expert directory, contributed writing in Attorney at Law Magazine, and three books published on Amazon covering cybersecurity strategy for executives.
Petronella Technology Group is registered as a CyberAB Registered Practitioner Organization #1449, has maintained a BBB A+ rating since 2003, and has served clients from the same Raleigh, NC office since 2002. The full team holds CMMC-RP credentials. Our forensic practice has supported investigations for law firms, engineering firms, insurance carriers, healthcare providers, manufacturers, and individual clients across NC and nationwide.
What Happens After You Call
Forensic engagements move at the pace evidence demands. Here is the realistic sequence when you reach us about an active incident.
Hour 0 - 2 (intake and scoping). An initial scoping call within two business hours of contact (24 / 7 for confirmed active incidents). Counsel, IT lead, and insurer (if applicable) on the line. We confirm what is happening, what is at stake, and the immediate evidence-preservation steps to take before our team arrives or remote-connects. No engagement letter required for the first call - we will not sit on advice you need now.
Hour 2 - 24 (preservation and triage). Engagement letter and forensic-services agreement signed. Remote evidence capture begins immediately where the environment supports it; on-site arrival within one business day for matters that require physical imaging in our Raleigh, NC lab. Volatile-memory capture, host imaging, log preservation, and chain-of-custody opening all happen in this window.
Day 2 - 14 (analysis and timeline). Forensic analysis on imaged evidence. We work on copies, not originals. Findings are correlated across host, network, and cloud sources before they are recorded. Status calls cadence to client preference - daily for high-pressure matters, twice-weekly for standard investigations.
Day 14 - 30 (reporting and remediation). Technical findings report and executive summary delivered. If the matter requires regulator notification, the supporting evidence pack is produced in parallel. Hardening recommendations - tied to our cybersecurity, penetration testing, and compliance practice areas - close out the engagement and feed into any post-incident control upgrade.
Long-tail (testimony and follow-up). If the matter heads to litigation, deposition, or arbitration, Craig provides expert-witness testimony on the findings. We accept testimony engagements only on matters our team personally worked - a posture that has held through every cross-examination.
Why DFE Discipline Decides the Outcome
A digital forensics engagement is rarely about finding evidence. The evidence is almost always there. The engagement is about whether the evidence survives long enough, in clean enough form, to be useful in front of the audience that matters - a judge, a regulator, an insurer, an arbitrator, or an internal HR panel that needs to make a defensible decision.
Evidence destruction by good intentions. The most common way evidence dies is not malice. It is an IT team trying to restore service. A helpdesk admin who reboots a compromised server because it is acting strange has just wiped volatile memory - the only place certain rootkits, in-memory implants, and credential-theft artifacts live. A sysadmin who copies log files to investigate has changed their access times. A well-meaning controller who hits "restore from backup" on a ransomware-encrypted host has eliminated the encryption key recovery path. None of those people intended to destroy evidence. All of them did. DFE discipline begins with telling the IT team, in the first phone call, what not to touch.
Chain of custody is a documentation problem, not a technology problem. The court does not care which forensic suite was used. The court cares whether the examiner can prove, by documentation, that the bits on the analysis disk are the same bits that were on the source disk at the moment of collection. That requires write-blocking hardware (so the source cannot be modified), dual-hash baselining (so the integrity can be proven), and a continuous custody log (so every touch is recorded). Get any of those three wrong and the opposing counsel has a Daubert challenge. Get them right and the methodology does not become the issue.
The "preserve everything" instinct is wrong. The opposite is also wrong. Either extreme breaks an investigation. Preserving everything ($) and then asking what to look for ($$$$$) is how forensic budgets balloon to seven figures and produce nothing useful. Preserving only what someone thought to look for is how the smoking gun ends up overwritten by a routine rotation. Forensic scoping is a triage skill - know the realistic data-loss volumes, the realistic retention windows, the cost of imaging this versus that source, and the realistic value of what each source can prove. That triage is the DFE credential's day job.
Insurance and regulatory deliverables have specific formats. Cyber insurance carriers want a specific evidence pack to validate a claim. State breach-notification laws have specific 4-factor risk-assessment frameworks. The HIPAA Breach Notification Rule has a specific risk-of-compromise standard. The 72-hour DFARS 252.204-7012 reporting clock has a specific DIBNet submission template. PCI DSS has a specific Card Brand reporting path. A generic IT investigation memo does not meet any of these formats. The forensic deliverable has to be built to the downstream audience or the engagement was wasted budget.
Testimony is the final filter. An expert witness who cannot defend the methodology under cross-examination has destroyed the case the firm spent six months building. Craig's testimony posture is conservative on purpose - he will testify on what he investigated, with the documentation he produced, against the methodology he can defend. He will not "borrow" credentials, will not stretch a finding past what the evidence supports, and will not testify on matters we did not personally work. That posture is why we win cross-examinations more than we lose them.
Typical Engagement Origins
Forensic work is rarely the first call - it is the third. By the time someone reaches us, the picture usually looks like one of these.
Counsel preparing for litigation. Attorneys at NC law firms reach us when a client matter hinges on digital evidence: a misappropriated customer list, an employee who took source code, an insurer dispute over a breach claim, a regulator inquiry. We work directly with law firms and litigation counsel, often under privilege, with deliverables structured for the case's downstream needs.
CFOs and controllers after a wire-fraud event. Business Email Compromise is now one of the most common entry points to our practice. A controller gets a "vendor banking-change" email, the wire goes out, and within hours the money is gone. We work the Microsoft 365 or Google Workspace side to identify the mailbox compromise, the malicious rules, and the OAuth grants that let the attacker watch the conversation - findings that support insurance claims, FBI IC3 reports, and any civil action against the recipient bank or mule.
IT leadership during an active ransomware or breach incident. CIOs and IT directors reach us when an incident has outgrown what the internal team can run alone. Our role: bring forensic discipline to a response that is already in motion, preserve evidence the response is at risk of destroying, and produce the documentation insurers and regulators will demand.
HIPAA covered entities facing a breach determination. Healthcare providers, dental practices, and behavioral-health groups reach us when an event raises the question of whether a reportable HIPAA breach occurred. Our work covers the forensic determination, the 4-factor risk assessment evidence pack, and coordination with HIPAA counsel on the 60-day notification clock. See our HIPAA compliance practice for the prevention layer.
DoD contractors triggering a CMMC or DFARS incident report. A contractor with CUI in scope hits an incident, and the 72-hour DFARS 252.204-7012 reporting clock starts. Our DFE-led forensics work supports the DIBNet submission, the CMMC remediation path, and our broader CMMC compliance consulting on the post-incident posture.
Individuals and family offices after a crypto-theft or SIM-swap event. Crypto theft is rarely a single-event problem - SIM-swap, pig butchering, romance scam, exchange hack, wallet drain. We work the on-chain and account-side of the incident, identifying destination wallets, mixer hops, exchange chokepoints, and the realistic ceiling on recovery. See crypto forensics and scam recovery for engagement detail.
Service-Area and Specialty Coverage
City pages serve NC regional searches with the same DFE bench; specialty pages cover deeper detail on individual disciplines.
Raleigh NC Digital Forensics
Durham NC Data Breach Forensics
Cary NC Data Breach Forensics
Network Forensics
Crypto Forensics and Scam Recovery
NC Expert Witness Testimony
24 / 7 Breach Response Raleigh
HIPAA Breach Notification Response
Server and Network Forensics
Data Breach Cost Calculator (Free)
Forensics Incident Response Playbook
Frequently Asked Questions
Do you do iPhone or iPad extraction or jailbreak imaging?
No. We do not run Cellebrite UFED, Graykey, EnCase mobile, or any consumer-device extraction toolchain - those subscriptions and the staff to operate them are not part of our practice. If your matter requires a full physical extraction of an iPhone or iPad, we will refer you to a partner lab that runs that toolchain.
What we do handle on the mobile side is breach response on corporate-owned or BYOD-managed devices: MDM telemetry, conditional-access logs, Mobile Application Management data, mailbox-sync history, and the cloud-side artifacts that show what data left the device into a tenant or third party. That is a different question than "image this phone" - and it is the one most BYOD breach matters actually need answered.
What types of matters are inside your scope?
Breach response, ransomware investigation, business email compromise, cloud-account compromise (M365 and Google Workspace), network and server forensics, malware reverse-engineering, crypto theft and on-chain wallet tracing, SIM-swap response, HIPAA breach determination, DFARS / CMMC incident reporting, insurance-claim support, and expert witness testimony on matters our team investigated.
What types of matters are outside your scope?
Consumer mobile-device extraction, iPhone or iPad jailbreak imaging, private investigation work (we are not a licensed PI firm), surveillance, process service, custody or divorce phone forensics, family-law device imaging, and traditional large-firm e-discovery on Relativity or Everlaw. When a matter falls in this list we refer to a vetted partner whose toolchain fits the work - the referral is part of why our credential stays defensible.
What makes digital evidence admissible in court?
Three things, in this order: (1) forensic imaging that creates an exact bit-for-bit copy of the source, (2) documented chain of custody that records every person who handles the evidence and every time it is accessed, and (3) analysis using validated forensic methodology that the courts accept. Hash verification (MD5 + SHA-256) proves the data has not been altered since collection. Our procedures meet NC Rules of Evidence, Federal Rules of Evidence, and Daubert admissibility standards.
Can you recover deleted files?
Often, yes - but with honest limits. When a file is deleted, the operating system marks the storage space as available but does not immediately overwrite the data. Our forensic tools scan storage at the sector level to recover deleted files, file fragments, and metadata. Success depends on the type of storage (traditional spinning drives retain deleted data longer than SSDs because of TRIM commands), the amount of new data written since deletion, and whether anyone took active steps to destroy the data. We will give you a feasibility read before the meter starts running, not after.
How quickly can you start an investigation?
For active incidents - confirmed breaches, ongoing ransomware events, suspected destruction of evidence - we begin preservation within 24 hours. Initial scoping calls happen within two business hours of contact during business hours, 24 / 7 for confirmed active incidents. Standard non-urgent investigations begin within three to five business days of engagement. If you suspect evidence is being destroyed right now, contact us immediately via the emergency response line or call (919) 348-4912.
Do you provide expert witness testimony?
Yes - with one rule. Craig Petronella (DFE #604180) provides expert witness testimony in NC state courts, federal courts, arbitration, and depositions, but only on matters our team personally investigated. We do not take "review the other side's work and testify" engagements where we did not handle the forensic work ourselves. Craig has testified on data breach causation, intellectual property theft, BEC, ransomware, employee misconduct, and digital-evidence authenticity.
What types of devices and data sources can you examine?
On the corporate side: Windows and Mac workstations, Linux and Windows servers, hypervisor hosts (VMware, Hyper-V), container platforms, external storage, network-attached storage, packet captures, firewall and proxy logs, DNS logs, M365 and Google Workspace tenants, Entra ID sign-in logs, OAuth grants, and managed-mobile telemetry (MDM, MAM, conditional access). On the consumer side: we do not image iPhones, iPads, or unmanaged consumer phones - we refer those matters out to a partner lab.
How much does a digital forensic investigation cost?
Cost depends on the scope: number of devices and log sources, volume of data, complexity of the timeline, whether expert testimony is on the table, and how quickly the matter must close. Simple single-host examinations start in the low thousands; complex multi-environment breach investigations with testimony can run significantly higher. We provide a detailed scope and fee estimate after an initial consultation - no engagement letter is required to get that estimate. Call (919) 348-4912 for a confidential discussion.
Will the investigation alert the person being investigated?
We design collection procedures to be as discreet as the situation requires. In corporate investigations we can image devices during off-hours or use remote-capture tools that do not surface to the user. In litigation matters, evidence collection is often governed by a court order or preservation letter that dictates timing and scope. We work with counsel to choose the right approach for each matter.
Do you work with law enforcement?
Yes - both directions. We support defense attorneys with independent forensic review of digital evidence, and we support law enforcement and civil counsel that need additional forensic capacity or specialized expertise (network forensics, crypto tracing, BEC). Where a civil matter has a parallel criminal proceeding, we coordinate to avoid conflicts with law-enforcement activity.
Adjacent Services and Education
Forensics is one practice area inside Petronella Technology Group. Where your need is broader than incident response, these are the adjacent services that round out the picture - or, if you would rather build the knowledge in-house, our Training Academy covers the foundations.
Things People Believe About Digital Forensics That Are Wrong
After two decades of intake calls, the same five misconceptions show up almost every week. Resolving them on the first call saves the engagement.
"It is too late, the system has been rebooted." Sometimes. Often not. Reboots destroy volatile memory and running-process state, but the on-disk evidence - logs, registry entries, file-system journals, application artifacts, browser history, cloud-tenant audit records, network telemetry on adjacent devices - is still there in most cases. The right question is not "has anything been touched" but "what is the realistic evidence picture given what has happened so far." We answer that question on a scoping call, not on a flat assumption.
"We have backups, so we have the evidence." Backups are not forensic copies. A backup captures intentional data; a forensic image captures every sector including allocated, unallocated, slack, and journal regions where the most useful forensic artifacts live. Backups also typically rotate the original data out of the analysis window. Backups are useful for recovery. They are rarely sufficient for forensic causation analysis.
"The IT team can handle this." Sometimes. For low-impact, non-litigation, non-regulator matters where no insurer is involved, internal IT response is often appropriate. The moment any of the following appears - litigation hold, regulator inquiry, insurance claim, HIPAA / DFARS / GLBA reporting obligation, employee misconduct dispute, intellectual-property theft, wire fraud over a meaningful threshold - the answer flips. At that point the question is not whether IT can do the work. It is whether the work can survive Daubert.
"You can recover the crypto we lost." Sometimes, partially. More often, the realistic ceiling is on-chain attribution, exchange-chokepoint identification, and a defensible loss documentation pack that supports an IRS theft-loss filing, an insurance claim, an FBI IC3 report, or civil action. The recovery-rate claims that flood crypto-theft search results are often misleading. We will give you an honest read on feasibility before we ask for a retainer.
"This is the same as IT security." Different disciplines, overlapping toolchains. Security is about preventing the bad event. Forensics is about reconstructing the bad event after it happened, in a way that holds up to scrutiny. The two practices share infrastructure - we run our forensic lab inside our broader cybersecurity and managed XDR practice - but the credentials, methodology, and deliverable formats are different. Treating forensics as a side-project of an IT engagement is how findings get challenged at the worst possible moment.
Add Digital Forensics Capability to Your MSP Practice
Partner with Petronella to add court-admissible digital forensics and expert-witness capability to your MSP service catalog - DFE #604180 credential, full evidence chain of custody, optional Fleet hardware add-on. Learn more at Digital Forensics for MSP Clients or explore the full MSP Partner Program.
Forensics engagements run on Hybrid SOW with a 15 percent referral spiff - review the MSP partner onboarding process for the MSA + NDA paperwork flow before your first client incident, or compare tier investment on the MSP partner program pricing page.
Need a Digital Forensic Investigation?
Confidential consultation, no engagement letter required for the first call. If your matter sits inside our scope, we can begin preservation within 24 hours. If it sits outside our scope, we will tell you and route you to a partner whose toolchain fits.
