Clearing up a doubt
Unusual behaviour, an alert, a suspicious email? A quick analysis to decide: a real incident or a false positive. You know within days, not weeks.
The firm · Analysis & investigation
Analyse the available traces and establish what they allow us to conclude.
A doubt, an alert, an incident: before deciding, you need to establish the facts. Galyct conducts three types of investigation, from a simple check to evidence that can be used in court. The aim is never to drown you in technical detail: it is to inform your decision.
First conversation confidential, no commitment. Don’t delete anything before talking to us.
01 · THREE LEVELS OF INVESTIGATION
From a simple check to usable evidence.
Not every situation calls for the same depth of analysis. Three levels, depending on whether you want to settle a doubt, understand a confirmed attack, or build a file that holds up in front of a third party.
Compromise analysis
The incident is confirmed. We reconstruct the attacker’s path: entry point, movements, data affected, persistence mechanisms. This is the foundation for remediation and for mandatory notifications (ANSSI, and the CNIL within 72 h).
Evidential forensics
Collect and preserve digital evidence according to best practice, for the bank, the insurer, the lawyer or the courts. A documented chain of custody, and reporting that non-technical people can read.
02 · THE QUESTIONS WE ANSWER
An investigation starts from a question, not from a tool.
Here are the ones we answer most often: what we examine, what the result allows us to state, and what it does not.
Where does this message really come from?
Technical headers, routing path, authentication (SPF, DKIM, DMARC), sending domain. We establish whether an email or a text message was spoofed, without always being able to name the real sender.
Has this account been compromised, and how far?
Logins, devices, forwarding rules, authorised applications, recovery methods. We establish the extent of the access and what may have been seen or changed.
Is this login legitimate?
Address, device, time, approximate geolocation, history. We tell usual access apart from abnormal access, without certainty about the identity behind the address.
Is this website or domain fraudulent?
Creation date, hosting provider, certificate, resemblance to a brand, reports. We assess a domain’s risk and its likely modus operandi.
Is this device compromised?
Installed applications, permissions, outgoing connections, persistence mechanisms, updates. We separate harmless symptoms from real signs of compromise.
What happened, and in what order?
Logs, notifications, timestamps, correlation between events. We rebuild a timeline that separates established facts from hypotheses.
03 · WHAT MATTERS
What destroys evidence, what keeps it
Digital evidence is fragile: once overwritten, it does not come back. Telling the moves that erase it apart from the material that remains usable as evidence changes the outcome of a case.
What destroys evidence
The reflexes that erase everything
Done in good faith, these actions sometimes make a case indefensible.
- Reinstalling a system or “cleaning up” a device
- Deleting messages, logs or histories
- Continuing to use a compromised account
- Modifying or moving the original files
What can serve as evidence
The material to preserve
Collected and preserved correctly, it keeps its weight over time.
- Login logs and technical addresses
- Email headers and original messages
- Timestamped screenshots
- Transaction statements and access traces
An incident has just happened? Don’t touch anything else.
Reinstalling, deleting, “starting from scratch”: the most natural reflexes are often the ones that destroy what could have protected you. Don’t delete anything, don’t reinstall anything, and have the situation assessed: we secure what can still be secured.
04 · THE DELIVERABLES
What you receive at the end.
An investigation is only worth what it allows you to decide. Our deliverables always separate what has been established from what is assumed, in line with the CODEX doctrine.
Factual analysis report
Established vs assumed, in line with the CODEX. A timeline of the attack, with no conclusion that the facts do not support.
Scope of the incident
The list of systems and data affected, and prioritised recommendations for remediation and mandatory notifications.
Evidential component
When the file must hold up in front of a third party: digital seals and a collection certificate, with a documented chain of custody.
05 · OUR HONESTY
What we establish, and what we do not promise.
Investigation establishes the facts with rigour. It does not rewrite what has already been overwritten, and it does not name a culprit without evidence. We prefer to be clear from the first conversation.
What we do not promise
No guaranteed result
Destroyed evidence may be gone for good, and attribution remains a matter of evidence.
- We do not guarantee to recover data that has already been overwritten
- We do not attribute an attack to a perpetrator without evidence to support it
- We do not guarantee the outcome of a banking, insurance or legal process
- We never promise a result: we commit to a method
What we commit to
Method and clarity
What depends on us, we deliver.
- Preserve what can still be preserved, without altering the originals
- Document every step: a traceable chain of custody
- Separate the established from the assumed, with no hasty conclusions
- Strict confidentiality: we never ask for your codes
Establish the facts before acting
Deciding without knowing means risking cleaning up what you have not understood, notifying too early, or wrongly accusing someone. Investigation gives your decision the foundation it lacks: what actually happened, and what the traces do (or do not) allow us to state.
A doubt to clear up, facts to establish?
A first conversation with an expert about your situation: confidential, no commitment, no sales pitch. We preserve what can still be preserved, then we reconstruct what happened.