Methodical collection
Screenshots, logs, headers, traces: gathered properly and timestamped, without altering the originals.
The firm · Digital evidence & forensics
Digital investigation and preservation of evidence.
Depending on the case, we collect the material available on workstations, accounts, email systems or storage media, then establish a timeline and documented findings. The report separates what has been established, the hypotheses and the limits of the collection.
First conversation free, confidential and with no commitment. Don’t delete anything before talking to us.
File · evidence
Integrity verified
Timestamped screenshot
08:14 · sealed
Original email header
08:16 · sealed
Login log
08:19 · sealed
SHA-256 fingerprint
Unbroken chain of custody
01 · WHY IT IS DECISIVE
Badly preserved evidence is worthless.
Reinstalling a device, deleting messages or continuing to use a compromised account often erases the very material that would have allowed you to defend yourself. The method matters as much as the content.
Intact preservation
Material preserved so that it remains usable as evidence over time, with a traceable chain of custody.
Usable reporting
A clear file that management, an insurer, a lawyer or an authority can use, without drowning anyone in technical detail.
02 · THE METHOD
Forensics, in four stages
The work follows a precise order. The traceability of each step is what gives the result its value: it is what allows the file to hold up in front of a third party.
1
Collect
Gather the material without altering it: screenshots, logs, headers, statements, original messages.
2
Preserve
Keep the material intact, timestamped and sealed, so that it retains its weight over time.
3
Analyse
Reconstruct the timeline and responsibilities from the traces, with method and documentation.
4
Report
Deliver clear conclusions: what happened, how, with what impact, so that decisions can be made.
An incident has just happened? Don’t touch anything else.
Reinstalling, deleting, “starting from scratch”: the most natural reflexes are often the ones that destroy what could have protected you. Don’t delete anything, don’t reinstall anything, and have the situation assessed: we secure what can still be secured.
03 · WHAT MATTERS
What destroys evidence, what keeps it
Digital evidence is fragile: once overwritten, it does not come back. Telling the moves that erase it apart from the material that remains usable as evidence changes the outcome of a case.
What destroys evidence
The reflexes that erase everything
Done in good faith, these actions sometimes make a case indefensible.
- Reinstalling a system or “cleaning up” a device
- Deleting messages, logs or histories
- Continuing to use a compromised account
- Modifying or moving the original files
What can serve as evidence
The material to preserve
Collected and preserved correctly, it keeps its weight over time.
- Login logs and technical addresses
- Email headers and original messages
- Timestamped screenshots
- Transaction statements and access traces
04 · WHAT IT IS FOR
A file that holds up in front of third parties.
Disputing a bank transaction, triggering insurance cover, filing a complaint, supporting a dispute: in all these cases, the strength of the file determines the outcome. The firm builds it so that it holds up.
Bank fraud
Put together the dispute and refund file, with supporting documents, for your bank.
Talk to an expert →Compromised account
Document the intrusion and identity theft for your dealings with platforms and authorities.
Talk to an expert →Incident in a business
Establish the facts for management, the insurer and the legal team, usable in a dispute or before an authority.
Talk to an expert →
05 · OUR HONESTY
What we promise, and what we do not.
Forensics establishes the facts with rigour. It does not rewrite what has already been overwritten. We prefer to be clear from the first conversation.
What we do not promise
No guaranteed result
Destroyed evidence may be gone for good.
- We do not guarantee to recover data that has already been overwritten
- We do not guarantee the outcome of a banking, insurance or legal process
- We never promise a result: we commit to a method
What we commit to
Method and clarity
What depends on us, we deliver.
- Preserve what can still be preserved, without altering the originals
- Document every step: a traceable chain of custody
- Deliver an understandable file
- Strict confidentiality: we never ask for your codes
06 · THE DOCTRINE
Incident response takes back control. Forensics establishes the facts.
The two complement each other: one stabilises the situation, the other reconstructs what actually happened. The Galyct firm brings these dimensions together and, where needed, coordinates all the parties to a sensitive case.
The aim is never to drown people in technical detail, but to inform the decision for management, a lawyer, an insurer or an authority.
Evidence to secure? Don’t touch anything else.
A first conversation with an expert about your situation: confidential, no commitment, no sales pitch. We preserve what can still be preserved, then we build the file.