Security software DFIR

monitoringdata protectionanalysis

Overview
Threat Response Unit DFIR provides Digital Forensics & Incident Response services to businesses and public administrations, combining reactive incident handling, forensic evidence production and proactive forensic readiness.

Main areas

• Incident response: rapid containment, eradication and mitigation of security incidents to reduce operational impact.
• CTU/CTP forensic consulting: forensic examinations compliant with chain-of-custody best practices to support judicial processes.
• Forensic readiness: preparation of processes, technologies and standards to ensure accurate, integral and verifiable digital evidence collection and preservation.
• Research & innovation: experimentation with eBPF, kernel telemetry, AI for anomaly detection and container forensics to anticipate threats and develop advanced tools.

Threat Analysis
The DFIR unit works across litigation, criminal, civil and arbitration cases, and in investigations of fraud, corruption and intellectual property disputes. Forensic readiness is offered as a preventive service enabling organisations to collect, retain and analyse electronic evidence in a legally defensible way. The team operates within a computer forensics laboratory and follows strict procedures for data acquisition, crystallisation and storage.

Activities

• Forensic-led management of cyber incidents
• Expert consulting for judicial authorities and legal teams
• Support in disputes on hardware and software design and implementation
• Documentary support for law firms in civil and criminal cases
• Assessment of internet-facing exposure of information systems
• Specialised consulting for brand protection and intellectual property
• Malware remediation for PCs and smartphones
• Support for safeguarding know-how and preventing data loss
• Assistance in cases of corporate misconduct and employment termination

Tools

• Cellebrite UFED
• Intella
• Axiom
• X-Ways
• Falcon
• GrayKey

Selected reports and publications

• Advanced Data Extraction in iOS Forensics: File Protection and Device Security
• Forensic Readiness 2025: Strategic Framework for the Usability of Electronic Evidence
• Deception Technology and Moving Target Defence
• Data Without Borders - Digital Forensics rewrites privacy
• GTG-1002 and the Chinese Espionage Ecosystem
• Uses and abuses of eBPF: threats, detection techniques and countermeasures - Part 1
• eBPF for Digital Forensics & Incident Response

Technical specifications

• Unit type: Threat Response Unit (Digital Forensics & Incident Response)
• Scope: support to businesses and public administrations; litigation, criminal, civil and arbitration proceedings
• Main capabilities: incident containment/eradication/mitigation, forensic evidence acquisition, forensic readiness, research & innovation
• Collaborations: integration with Security Operations Centres (SOCs) for proactive detection, threat hunting and crisis management
• Team: technicians specialised in cyber incident response and forensic evidence acquisition
• Laboratory: computer forensics laboratory with procedures for acquisition, crystallisation and secure storage
• Tools used: Cellebrite UFED, Intella, Axiom, X-Ways, Falcon, GrayKey
• Research focus: eBPF, kernel telemetry, AI for anomaly detection, container forensics