Endpoint acquisition
Forensic imaging, volatile-memory capture, artifact collection and preservation planning for workstations, laptops and removable media.
Case console / EH-2026-0831custody: intact
Digital forensics · incident reconstruction · expert reporting · fictional practice
Facts survive when handling does.
Evidence House reconstructs what happened across endpoints, cloud accounts, logs and storage media without turning uncertainty into theatre. We preserve the record, explain the limits and make the analysis reproducible.
IMAGE_04.E01VERIFIED
SHA256 8c3f...a81e · source NVMe-02 · write blocked · acquired 02:14 SAST
About / laboratory rule
A persuasive story is not the same thing as a defensible finding.
Every conclusion carries its source. If a timestamp comes from an application database, a cloud audit log or a filesystem artifact, the report says so. If two clocks disagree, that disagreement becomes evidence too.
We separate acquisition from interpretation, preserve originals, work from verified copies and record tool versions, assumptions and exclusions. That discipline lets another competent examiner follow the same trail.
Capabilities / evidence channels
Cloud reconstruction
Identity logs, mailbox activity, file history, administrative actions and service-specific audit trails assembled into a common timeline.
Incident chronology
Events from multiple sources normalized around clock drift, timezone, user identity and known gaps to explain sequence rather than merely list alerts.
Expert reporting
Technical findings translated into sourced statements, exhibits, limitations and methods suitable for counsel, insurers, boards or disciplinary teams.
Process / chain of custody
One unbroken record from instruction to exhibit.
01
Authority
Confirm scope, legal authority, systems in play and preservation urgency before touching evidence.
02
Preserve
Collect or image the source with write controls, hashes and custody entries suited to the medium.
03
Examine
Work from verified copies, documenting tools, search strategy, filtering and material exclusions.
04
Correlate
Join artifacts into tested hypotheses, then challenge chronology against contradictory or missing records.
05
Report
State findings, confidence, limits and source references. Package exhibits so the path back to evidence remains clear.
Projects / reconstructed case files
Redacted examples. Visible reasoning.
EH-24-031
closed / redactedMailbox access dispute
Audit logs showed successful sign-ins from a managed device before the employee's departure, while message-deletion events occurred days later through an administrator account. The report separated access from deletion rather than attributing both to one actor.
EH-24-044
closed / redactedRansomware entry path
Endpoint artifacts, VPN logs and file-server timestamps supported a credential-reuse entry 11 hours before encryption. A missing sensor window was explicitly marked rather than back-filled by inference.
EH-24-057
closed / redactedSource-file provenance
Version history, local metadata and repository commits established which design files existed before a supplier engagement and which were created afterward. Hashes linked every exhibit to the acquired source.
100%
reported exhibits hash-referenced
0
original evidence sources modified during lab imaging
4 h
priority preservation response target
2-person
peer review on material opinion reports
People / examiners
Names stay attached to opinions.
Nandi Khumalo
Lead examiner
Endpoint artifacts, timeline reconstruction, peer review
David Meyer
Cloud forensics
Identity, collaboration suites, audit and retention systems
Rehema Patel
Evidence manager
Custody, exhibit production, validation and disclosure control
Insights / lab notes
Clock drift changes stories
Five minutes between an endpoint clock and an identity provider can reverse apparent sequence. Normalize clocks before attributing cause.
A screenshot is an illustration
Screenshots help explain findings but rarely preserve enough provenance on their own. The underlying artifact should remain identifiable.
Silence is not absence
A missing event may reflect disabled logging, retention expiry or collection scope. A report should distinguish not found from did not happen.
FAQ / before collection
Can you investigate a live system without shutting it down?
Sometimes. We choose acquisition methods around volatility, business impact and evidential goals. A live capture can preserve memory and active connections, but it also changes state, so the decision is documented.
Do you guarantee that deleted data can be recovered?
No. Recovery depends on storage type, overwrite activity, encryption, retention settings and what happened after the event. We describe recoverability before promising outcomes.
Can findings be used in disciplinary or legal proceedings?
The work is designed to be explainable and reproducible. Whether a specific report is admissible remains a legal question for the instructing team and relevant jurisdiction.
What should we do before handing over a device?
Stop unnecessary handling, record who has access, preserve power state where appropriate, and contact the lab before improvising. Good custody starts before the courier arrives.
Secure intake / first instruction
Preserve first. Interpret second.
For urgent incidents, send only enough detail to identify the systems, preservation risk and decision deadline. Sensitive evidence transfers are arranged after scope and authority are confirmed.
channel: intake@evidence-house.example
priority: +27 11 555 0850
response: 24/7 preservation triage
Request secure intake