Digital Forensics Capability
For Your Regulated MSP Clients

How can an MSP offer digital forensics to its clients?

An MSP offers digital forensics by partnering with a licensed examiner instead of building a lab. Petronella Technology Group, Inc. provides that examiner: founder Craig Petronella is a Digital Forensic Examiner, DFE #604180. Your MSP keeps containment and recovery, and Petronella performs evidence preservation, analysis and the signed report. MSPs join free as a Petronella Partner and choose a 10% referral or a per-deal white-label quote.

• Examiner: Craig Petronella, Digital Forensic Examiner #604180, CMMC-RP, CCNA, CWNE, MIT-Certified in AI and Blockchain, with 30+ years of personal experience in the field.
• Firm: Petronella Technology Group, Inc., founded April 5, 2002 in Raleigh, NC; Cyber AB Registered Provider Organization #1449; BBB A+ accredited since 2003; a CMMC Registered Practitioner Team; a 24/7 SOC; a 2-hour response commitment.
• Cost to join: $0. There is no membership fee. You pay nothing until a client deal exists, and under the referral option you never pay at all.
• Names on the work: forensic reports and testimony always carry the licensed examiner and the Petronella Technology Group, Inc. name, because admissibility depends on who performed the work.
• Your role: you keep the client relationship, run containment and restoration, and coordinate logistics with counsel and the insurer.

Why Your MSP Needs Forensics Capability on Retainer

If your MSP serves defense contractors, healthcare providers, financial firms, or any organization under regulatory oversight, you are one incident away from a client asking a question you cannot answer: "Can you preserve the evidence and testify to what happened?"

The answer matters for four reasons that go far beyond technical curiosity:

• Incident response and breach notification. Regulatory frameworks including HIPAA, CMMC, PCI-DSS, and state breach-notification statutes require documented forensic investigation before notification deadlines trigger. Clock starts at discovery, not at convenience.
• Compliance evidence. Post-incident, your client's compliance posture is under a microscope. An auditor or assessor will ask for chain-of-custody logs, forensic acquisition records, and a root-cause analysis signed by a credentialed examiner. Internal IT notes do not satisfy that requirement.
• Legal holds and litigation support. When a client is sued or suing, opposing counsel demands electronically stored information under rules that require forensic-grade preservation. The MSP operating the environment cannot credibly testify about its own work because the conflict of interest destroys credibility on cross-examination.
• Insurance claims. Cyber-insurance carriers increasingly require forensic reports from a credentialed third party before paying claims. A report from the MSP that managed the compromised environment does not meet that standard.

The structural problem is that building this capability in-house requires a licensed Digital Forensics Examiner, specialized acquisition tooling, evidence-vault infrastructure, and expert-witness readiness. That combination costs years of credentialing effort and six figures annually to maintain for work that arrives unpredictably.

Craig Petronella's DFE Credential and What It Means

Craig Petronella holds DFE #604180, a Digital Forensics Examiner credential that authorizes forensic acquisition, analysis, and expert-witness testimony. The credential is a personal license tied to Craig, not a company certification that can be assigned to any employee.

For your MSP clients, this means:

• Forensic reports carry a named, credentialed examiner whose qualifications can withstand a Daubert challenge or Frye hearing.
• Chain-of-custody documentation follows standards accepted in federal and state courts across the Southeast.
• Expert-witness testimony, when a matter requires it, is delivered by the same licensed examiner who performed the forensic work.
• The examiner operates under PPSB (Private Protective Services Board) oversight as required for investigative work in North Carolina.

Petronella Technology Group, Inc. has delivered cybersecurity services since April 5, 2002, holds BBB A+ accreditation since 2003, and operates from 5540 Centerview Dr, Raleigh, NC. The whole team is a CMMC Registered Practitioner Team, in addition to Craig's DFE credential, which matters when a forensic investigation uncovers compliance deficiencies that need immediate remediation.

How the DFE Add-On Works Within Fleet Engagements

Digital forensics is an optional add-on to Petronella Fleet engagements. It is not included by default in any prototyping tier because forensic work is scoped per-incident, not bundled into infrastructure projects. This keeps your base Fleet engagement pricing clean and prevents you from paying for capability you may not need on every deal.

Two engagement models cover the range of forensic needs:

Use Cases Your MSP Can Position

When you tell a prospective regulated-SMB client that your MSP has a forensics-certified partner on retainer, you immediately differentiate from every competitor whose incident-response plan ends at "we'll call our vendor." Here are the scenarios where that positioning converts to revenue:

Ransomware Response for Defense Contractors

A defense contractor client suffers a ransomware event. DFARS 252.204-7012 requires the contractor to report the incident to the DoD within 72 hours of discovery and to preserve images of affected systems for at least 90 days. The forensic examiner acquires images, reconstructs the attack timeline, prepares the mandatory report, and provides the preserved media that satisfies the DFARS obligation. Your MSP handles containment and restoration. The client sees one coordinated team, not two vendors discovering each other's existence during a crisis.

HIPAA Breach Investigation

A healthcare client discovers unauthorized access to systems containing protected health information. The HIPAA Breach Notification Rule requires a risk assessment to determine whether notification is required, and that assessment must be based on forensic evidence, not assumptions. The forensic examiner documents scope of access, data potentially exposed, and whether encryption or other protections were in place at the time of access. The MSP uses this report to support the client's legal counsel in making the notification determination.

Insider Threat for Financial Firms

A departing employee at a financial services client copies client lists, pricing models, and proprietary trading algorithms before resignation. The firm's legal counsel needs forensic evidence of what was taken, when, and how. The examiner preserves the employee's workstation, analyzes cloud sync logs, and produces a report suitable for a temporary restraining order hearing. The MSP continues to manage the environment and implements the access controls that prevent recurrence.

Expert-Witness Testimony

Your client's attorney needs a technical expert to file a declaration, sit for deposition, or testify at trial about what happened in a cyber incident. The expert must be independent of the MSP that operated the environment because the MSP cannot credibly testify about its own work. Craig Petronella serves as the independent expert while your MSP maintains the client relationship and continues managed services.

The first hours of an incident: what your technicians should do

Most evidence is lost in the first hours, and usually by well-meaning people. The instinct of a good MSP technician is to restore service fast: wipe the infected machine, reimage it, reset every password and move on. Each of those steps destroys artifacts an examiner needs later. Agree on a short first-hour routine with your team now, before a client calls in a panic.

1. Do not wipe, reimage or power off affected systems. Volatile memory disappears at shutdown, and a reimage overwrites the disk. Isolate the machine from the network instead, by unplugging the cable or disabling the switch port, and leave it running.
2. Preserve logs before they roll over. Export firewall, VPN, EDR and identity-provider logs for the affected period. For Microsoft 365 and Google Workspace, export the audit logs you can reach now; retention depends on the client's license.
3. Write down who touched what, and when. A simple running log (time, person, system, action) becomes the start of the chain-of-custody record. Undocumented handling is what opposing counsel attacks first.
4. Stop sharing details over the compromised channel. If the email tenant is compromised, coordinate by phone or a separate channel. Attackers read the incident thread.
5. Call counsel and the insurer early. Many cyber policies require notice before you engage vendors, and counsel decides whether the examiner should be retained through the law firm to protect privilege.
6. Bring in the examiner before the rebuild. Acquisition first, restoration second. A short delay to capture images usually costs less than an investigation with no evidence.

Put this routine in your incident response plan and in the client's plan. It is also a practical answer to the incident response questions that HIPAA risk analyses and CMMC assessments ask about.

How to position forensics in your service catalog

A forensics partner changes what your MSP can promise in a sales conversation. Instead of "we will call someone", your incident response plan names a licensed examiner, a preservation routine and an escalation path. Three places to put it:

• The master services agreement. State that forensic investigation is performed by an independent licensed examiner and billed separately. This protects your MSP from being asked to investigate its own environment, which is the conflict that ruins testimony later.
• The client's incident response plan. List the examiner's contact path next to the insurer and counsel. When the plan is tested or audited, the answer to "who investigates?" is already written down.
• Your quarterly business reviews. Regulated clients ask what happens after a breach. A named examiner with a verifiable license is a concrete answer, and it gives you a reason to review the client's logging and retention settings.

Forensics work arrives unpredictably, so it rarely pays for an MSP to staff it. It pays to be the MSP that already has the answer when the call comes.

What Forensic Work Cannot Be White-Labeled

Forensic findings and expert-witness testimony must carry the licensed examiner's name to be admissible in civil or criminal proceedings. This is not a branding preference; it is a legal requirement. Craig Petronella's DFE license is a personal credential, and his name appears on every forensic report and every piece of testimony.

Your MSP stays in the engagement as the client's primary technology relationship. You introduce the matter, you coordinate logistics, and you continue all managed-services work. Petronella's statement of work names Craig Petronella DFE #604180 as the performing examiner. For active litigation, the engagement is typically structured as a direct contract between the examiner and the client's legal counsel to preserve attorney-client privilege and work-product protections.

Petronella Partner, $0 to join

The simplest way to bring forensics to your clients is the free partner agreement. There is no membership fee. You sign one Petronella Technology Group, Inc. partner agreement and choose how you want to work on each client deal: referral, white label, or both.

Terms that apply to both options

• Register each client deal before it is quoted. Petronella approves or declines a registration within 5 business days. An approved registration is valid for 90 days and can be renewed while the opportunity is active.
• Some documents always carry the Petronella Technology Group, Inc. name and cannot be rebranded: attestation letters, documents signed by credentialed personnel (for example a Digital Forensic Examiner or a CMMC Registered Practitioner), submissions to regulators, assessors or auditors, and Business Associate Agreements. For forensics, that includes the examiner's report and any testimony.
• The agreement runs for 1 year and renews automatically unless either side gives 30 days' notice. It is non-exclusive for both sides.

What happens after you apply: send the free application and choose Petronella Partner. Our team reviews it within two business days. If it is a fit, we send the partner agreement for electronic signature, and you elect referral, white label or both when you sign.

Want training and a member community as well? Petronella MSP Stack is the optional paid membership. It is not required to be a partner.

Which option fits forensics work?

Litigation matters usually fit the referral option, because counsel often retains the examiner directly to protect privilege, and the report must carry the examiner's name either way. Incident response for a client you manage can fit white label: you remain the client's provider of record, and the examiner's report still issues under the Petronella Technology Group, Inc. name. We confirm the structure on the scoping call for each matter.

Related Capabilities Within the MSP Partners Program

• Petronella Fleet for the prototyping and infrastructure engagement that forensics attaches to as an add-on
• CMMC assessment practice for defense-sector clients who need post-incident compliance remediation
• HIPAA compliance practice for healthcare clients requiring breach investigation and notification support
• Apply free as a Petronella Partner to set up your agreement and escalation path before you need it
• CMMC compliance for MSP clients for defense contractors whose incident also triggers DFARS reporting
• The free MSP CMMC and Private-AI Profit Playbook for packaging compliance and incident response services
• MSP Partners program hub for the free partner entry and the optional paid tiers

Frequently Asked Questions