How Digital Forensics Investigation Works
A four-phase forensic methodology built around Identify, Preserve, Analyze, and Report. Petronella Technology Group handles cybercrime investigations for Raleigh, Durham, Chapel Hill, and businesses across North Carolina and the Southeast.
Why Is Process the Product in Digital Forensics?
When your business is staring down a breach, a suspected insider threat, a wire-fraud loss, or a crypto theft, the value of a digital forensics engagement is not the tools we open on day one. It is the discipline of the process we follow from the first phone call through the final report. Petronella Technology Group has been doing this work in North Carolina since 2002, and every investigation we take on moves through the same four phases in the same order. The phases exist because digital evidence is fragile. A single careless reboot, a well-meaning IT administrator running malware cleanup before artifacts are preserved, or an endpoint detection tool auto-quarantining a binary can turn a recoverable case into a lost one.
Our methodology aligns with the NIST SP 800-86 guide for integrating forensic techniques into incident response and with the ISO/IEC 27037 standard for identification, collection, acquisition, and preservation of digital evidence. We do not need exotic tools to do good work. Most of what we use is built on battle-tested open-source tooling that has been cited in court filings for years, paired with the written procedures that let another examiner reproduce our findings step for step. That reproducibility is what makes our work defensible in front of your counsel, your insurance carrier, your regulator, or a judge.
We also write every engagement so it can be handed off. If our work product becomes evidence in a civil suit, our report should give your attorney everything they need to bring in a second expert for review. If the case moves to criminal referral, our timeline should fit cleanly into a search warrant affidavit. If your cyber insurance carrier needs proof of a covered event and reasonable remediation effort, our chain-of-custody documentation should satisfy them without follow-up calls. Good process removes friction later.
What Are the Four Phases of a Digital Forensics Investigation?
Every engagement follows the same four phases in the same order. Skipping a phase or reordering them compromises the integrity of the evidence and the defensibility of the conclusions.
Initial Consultation and Scoping
We map the incident surface, identify every custodian and data source that could hold relevant evidence, and define a scope you and your counsel can sign off on before anyone touches a device.
Read the full phase guideCollection and Preservation
Write-blocked acquisition, volatile-first ordering, SHA-256 hash verification, and chain-of-custody forms started before any analysis begins. The evidence we analyze is never the evidence your team is using.
Read the full phase guideForensic Analysis
Working copies loaded into Autopsy, The Sleuth Kit, Volatility, Zeek, Wireshark, and purpose-built Python tooling. Timeline reconstruction, indicator extraction, on-chain tracing, mail-header analysis, and log correlation.
Reporting and Expert Consulting
Written report with executive summary, reproducible methodology, evidence appendix, and expert consulting support for your counsel, insurer, or regulator. Hand-off ready for second-examiner review.
Read the full phase guideWhat Cases Does Petronella Technology Group Actually Investigate?
Our team has a specific focus. We stay in lanes where we can do defensible work, and we refer cases that fall outside that scope to a trusted partner network so you still get the right help.
Core Specialties
Petronella Technology Group focuses on the incident types that hit small and mid-sized businesses in North Carolina most often and where we have the deepest bench of experience.
- SIM swap attacks and account takeover recovery
- Crypto forensics, wallet tracing, and on-chain analysis
- Pig butchering and investment scam recovery
- Ransomware forensics and incident response
- Business Email Compromise and wire-fraud forensics
- Network forensics and breach timeline reconstruction
Referred to Partners
Some forensics work requires tool licenses or licensure we do not hold. We will say so on the first call, and we will connect you with a trusted partner who can handle it end to end.
- Physical surveillance or process service
- Mobile device physical extraction
- Large-firm review-platform e-discovery
- Family-law and custody device imaging
- Vehicle-infotainment and IoT device forensics
How the Process Looks in Practice
Anonymized summaries of engagement patterns we see most often. No client identifiers, no fabricated detail. These are the kinds of cases our four-phase process is built around.
The Friday-Night BEC That Everyone Called a Typo
A North Carolina manufacturer wires mid-six figures on a Friday afternoon to a supplier they have worked with for years. The wire instructions came in by email, reviewed by the controller, matched the supplier's stationery, and referenced a live purchase order. The wire hits the receiving bank and is gone by Monday. The controller is embarrassed, the CFO is furious, and the IT team is digging through mail logs with no clear answer. We get the call Tuesday morning.
In Phase 1 we scope the incident around the controller's mailbox, the CFO's mailbox, the shared accounts-payable mailbox, the supplier-facing relationship manager's mailbox, the M365 tenant audit log, and the endpoint used by the controller. Phase 2 preserves mailbox exports, unified audit logs, sign-in logs, and a memory plus disk image of the controller's workstation before anything else is touched. Phase 3 finds a mail-forwarding rule created through an OAuth-consented third-party app three weeks earlier, a typo-squatted sender domain registered two weeks before the wire, and a TeamViewer session that ran for seven minutes on the night the fraudulent purchase order was edited. Phase 4 ties it together in a report the client hands to their insurance carrier, which triggers payout under the social engineering fraud rider. Counsel uses the same report to support a recovery demand against the receiving bank. None of this was possible without preservation on day one.
The Ransomware Negotiation That Never Happened
A dental practice is hit with ransomware on a Sunday night. Their MSP runs a well-meaning malware cleanup Monday morning before calling us. By the time we are engaged, the primary infected workstation has been reimaged, the server has been rolled back from a three-day-old VM snapshot, and three of the encryption binaries are gone. What is still intact is the firewall, the RMM tool logs, and a backup of the infected endpoint's memory from a third-party EDR agent that happened to be running. Phase 2 preserves those sources. Phase 3 identifies the initial access as a phished MSP technician credential, recovers the ransomware strain family, confirms no evidence of data exfiltration from the firewall NetFlow, and documents that the file-server impact was bounded to a known set of shares. Phase 4 gives the practice written evidence of non-exfiltration, which matters enormously for their HIPAA breach determination under the four-factor risk assessment. They file a low-risk determination with documentation, their insurance recovers the MSP's emergency work, and they do not pay the ransom. A measured forensic approach beat an impulse to pay.
The Crypto Theft Where We Followed the Money
A retail investor in Raleigh loses low-seven figures to a pig-butchering romance-investment scheme routed through a fake trading platform. By the time we are engaged, the funds have already moved through a first mixer. Phase 1 scopes around the original wallet addresses, the bridge transactions, and the communication channels. Phase 2 preserves browser history, Telegram and WhatsApp exports, email correspondence, and the victim's wallet transaction records with cryptographic signatures attached. Phase 3 traces the funds across chains using public on-chain analysis techniques, identifies a deposit address on a centralized exchange that is within US legal reach, and documents the transaction graph with block heights and transaction IDs preserved for court. Phase 4 delivers a report the victim's attorney uses to secure a subpoena on the exchange and initiate a civil freeze. Not every case ends in recovery, but defensible evidence makes recovery possible.
What Do You Need to Provide on Day One?
A short briefing call, a few decisions, and a handful of pieces of context is enough to get a case moving in the right direction.
Confidential briefing call
Thirty to sixty minutes with the person or people who know the incident best. No tools touched yet.
Counsel of record
If you have outside counsel, we work under privilege from the first call. If not, we flag where you might want them.
Evidence freeze instructions
We tell your team what to stop doing immediately. Rebooting, re-imaging, and malware cleanup can destroy the case.
Device and data inventory
Short list of every endpoint, cloud tenant, mailbox, and log source that may hold evidence. We help you build it.
Written engagement scope
Scoped in writing before any acquisition. Fixed boundaries on what we image, analyze, and report on.
Preservation hold notice
Where counsel is involved, we help draft the preservation hold language for internal custodians and cloud providers.
Which Well-Meaning Actions Hurt a Forensic Case the Most?
Most of the evidence loss in a cybercrime investigation happens in the first 24 hours, and it happens because good people are trying to help. If you are reading this during an incident, here is the short list of things to stop doing right now.
- Do not reboot affected systems. Volatile memory contains running processes, network connections, decryption keys, and injected code that will be gone forever the moment you power-cycle. If you can leave the machine running and disconnect its network cable instead, do that.
- Do not reimage yet. Reimaging in the first 48 hours trades a recoverable forensic case for a clean laptop. Spin up a replacement device for the user if they need to work, and let our team image the original first.
- Do not let anti-malware clean. Quarantine and auto-remediation silently destroy the malicious binaries and persistence mechanisms we need to identify for attribution, insurance claims, and forward protection. Disable automatic cleanup on the affected hosts until evidence is collected.
- Do not delete the suspicious email. Whether it is a phish that started the BEC or a negotiation message from a ransomware operator, that message is evidence. Preserve it with full headers intact. Forward copies to your forensic team with the original left in the mailbox.
- Do not restore from backup before triage. Rolling a server back to a pre-incident snapshot before forensic collection means we may never establish how the attacker got in. You will patch the symptom and live with the root cause.
- Do not talk to the attacker alone. If a threat actor is in active communication with someone at your company, loop in your forensic team and counsel before the next message goes out. Casual replies have reshaped entire legal strategies in the wrong direction.
None of these mistakes are career-ending. We have recovered cases where every one of them happened. But every mistake narrows the investigation and raises the cost, and avoiding them is free.
The Open-Source Forensic Stack We Run
We lean on a small, well-understood open-source toolkit and document every command we run. Nothing exotic, nothing proprietary that would lock a client into us for future work.
Acquisition
Write-blocked imaging is done with dd, dc3dd, and ewfacquire from the libewf project. We prefer the E01 Expert Witness format from libewf for compressibility and inline hash verification, with raw dd as a fallback when the case calls for a format-neutral image. Every acquisition is paired with an MD5 and a SHA-256 hash recorded at collection, embedded in the image file where the format supports it, and written into the chain-of-custody log. Memory acquisition uses lime on Linux hosts, winpmem on Windows hosts, and OSXPmem on macOS. For cloud artifact collection we use vendor-native export APIs where available, documented so our steps are reproducible by a second examiner.
Analysis
The Sleuth Kit and Autopsy carry the load for disk-image analysis. They give us timeline construction, deleted-file recovery, NTFS and ext4 metadata extraction, and signature-based file identification. Volatility 3 handles memory forensics: process listing, injected code detection, handle analysis, and registry extraction from page-cached hives. For network evidence we use Wireshark for interactive packet work and Zeek for corpus-scale analysis that produces conn, dns, http, ssl, files, and weird logs. Suricata gets pointed at packet captures to replay traffic against updated signature rules. Yara rules let us hunt for known indicator patterns across images and memory. Everything gets glued together with Python scripts that write to versioned Jupyter notebooks so the analysis steps stay auditable.
Crypto Tracing
For crypto cases we work the public blockchain directly. We use open-source clients and block explorers, pair them with graph-visualization tooling, and preserve the raw transaction records with block heights and timestamps before we build any narrative. Where a case reaches a centralized exchange that has US legal exposure, our report preserves the specific deposit-address-to-wallet trail your counsel needs for a subpoena. We do not replicate the full capability of commercial chain-analysis platforms, but we match them well enough for the tracing work that matters in most theft, scam, and recovery cases we see.
Log Correlation
Business-email-compromise and cloud-tenant cases are log-heavy. Microsoft 365 Unified Audit Logs, Azure AD sign-in logs, Exchange message trace, OAuth app grants, and per-mailbox MAPI connection records are the usual core set. Google Workspace cases add Admin Audit logs, Drive audit, and Gmail log search. We normalize these into a common event schema, reconstruct the attacker session timeline, and identify first-compromise indicators that often sit weeks before the financial event.
Regulatory and Framework Fit
Our process is built to satisfy the frameworks our clients answer to, so forensic work becomes an asset during audits, breach notifications, and insurance claims rather than another pile of open questions.
NIST SP 800-86
Guide to integrating forensic techniques into incident response. Our four phases map directly onto the NIST collection, examination, analysis, and reporting model.
ISO/IEC 27037
Guidelines for identification, collection, acquisition, and preservation of digital evidence. Our chain-of-custody and preservation procedures are built to this standard.
HIPAA Breach Risk Assessment
The four-factor risk assessment under 45 CFR 164.402 lives or dies on preserved evidence. Our Phase 2 preserves the log sources and endpoint state that let covered entities document a low-probability determination.
CMMC and NIST SP 800-171
Incident Response family controls (IR-4, IR-5, IR-6) require documented investigation and reporting. Our reports serve as the IR evidence a CMMC assessor looks for in a live-incident scenario.
Cyber Insurance Claims
Carriers require documented proof of loss, documented investigation, and reasonable remediation effort. Our chain-of-custody and methodology sections are written so claim adjusters can verify coverage without chasing our team for follow-up.
Federal and NC State Court Standards
Our reports are structured to support Daubert reliability challenges and FRE 702 qualification standards. Methodology is documented, peer-reviewed internally, and reproducible.
Explore Our Forensic Services
Frequently Asked Questions
How fast can Petronella Technology Group start an investigation?
For an active incident, we aim to have a scoping call on the phone within business hours the same day and onsite or remote collection moving within 24 hours. For lower-urgency matters like a civil dispute or an internal investigation, we schedule the kickoff call within two business days.
Do you work with our outside counsel so findings stay under privilege?
Yes. When counsel engages us directly or when you ask us to work through counsel, we structure the engagement letter, communications, and deliverables to stay within the attorney work-product and attorney-client privilege framework. We will not discuss findings outside the protected channel unless you and counsel direct us to.
What forensic tools do you use?
Our core toolkit is open-source and validated against known test images. For acquisition we use dd, ewfacquire from libewf, and dc3dd. For analysis we use The Sleuth Kit, Autopsy, Volatility for memory, Zeek and Wireshark for packet and log analysis, Yara for indicator matching, and custom Python tooling for crypto tracing and log correlation. Every tool we run gets documented in the methodology section of the report so another examiner can reproduce our findings.
Are your reports admissible in court?
Our reports are written to the standard that courts expect from technical expert work: documented methodology, reproducible analysis, evidence appendix with hash verification, and a clearly stated scope. Admissibility is ultimately the judge's call and depends on the case, but our reports are structured to support your counsel's motion-in-limine and Daubert-style challenges. We support your counsel as expert consultants and can testify where warranted.
What does a digital forensics investigation cost?
Cost depends entirely on scope: how many custodians, how many devices, how much data, and how urgent. A targeted BEC investigation with one or two custodians is meaningfully less than a multi-endpoint ransomware timeline reconstruction. We quote fixed-scope engagements where we can, and we always give you a written estimate before acquisition begins. There is no charge for the initial scoping call.
What if the case needs mobile-device imaging or specialty tools you do not have?
We will tell you on the first call. Our specialty scope covers SIM swap, crypto, BEC, ransomware, network forensics, and cloud-artifact forensics. For physical mobile-device extraction, traditional large-firm e-discovery review-platform work, or licensed private-investigator services, we refer to trusted partners we have vetted. You get the right team on the right piece of the case, and we stay in our lane.
Engagement Patterns by Client Type
The four-phase process is the same for every case, but the shape of the engagement changes based on who is calling us and why. Knowing where you fit on the spectrum helps you know what to expect from the first 48 hours.
Small and Mid-Sized Businesses
The majority of our forensic engagements come from North Carolina SMBs in the middle of a live incident. The call usually comes from the owner, the CFO, or an outside IT provider who does not have forensic depth. Our role is triage first, evidence preservation second, and investigation third. We tell you what to stop doing, we image what needs imaging, and we write a report that does triple duty: insurance, legal, and operational lessons learned. The engagement typically runs two to six weeks depending on scope.
Law Firms Engaging Us for Clients
When counsel engages us directly, the engagement letter, communications, and deliverables are structured to fall within attorney work-product protection. The law firm is our client. The underlying party is the subject of the investigation. We support the lawyer's strategy and stay out of strategic decisions that belong to counsel. Typical engagements here include insider threat investigations, partner disputes with suspected data theft, and civil discovery where the opposing side has handled evidence in ways that need forensic examination.
Cyber Insurance and Breach Counsel Panel Work
For insurance-driven incidents we work within the carrier's incident-response panel structure. The breach coach leads, forensic work fits into the claims workflow, and our reports are written so the adjuster can close the file without iterative questions. We coordinate with outside PR, ransom-negotiation specialists, and notification vendors where the incident calls for them.
Compliance-Driven Investigations
Regulated clients, especially healthcare practices under HIPAA and defense-industrial-base contractors under CMMC, sometimes need forensic investigation to satisfy a specific control or breach determination requirement. These engagements are often smaller in scope but tighter on documentation. Our report becomes an audit artifact, which means the methodology section needs to stand on its own without a verbal briefing.
Start Your Investigation Today
If you are in the middle of an incident, the sooner we are on the phone the more evidence we can save. If you are planning ahead, a scoping call now means we are already cleared when something breaks.