The cleanup destroyed the clues.
3PS identifies what to preserve before resets, reinstalls, mailbox cleanup, or policy changes hide the path.
Digital forensics and incident records
Preserve the evidence.
When something suspicious happens, the fastest way to lose the truth is to let everyone start changing the scene. 3PS preserves evidence, builds the timeline, scopes exposure, and gives leadership a defensible record.
EvidenceIdentity, email, endpoint, cloud, firewall
QuestionWhat happened, where, and what changed?
OutputTimeline, scope, actions, evidence
Incident truth disappears fast. Preserve it first.
Collect. Scope. Prove.What this looks likePreserve first. Clean later.
The first scramble can destroy the only clean timeline.
A suspicious mailbox rule appears, a laptop starts acting wrong, and three vendors want to "fix it" at the same time. Before resets or rebuilds, 3PS freezes the evidence that can still explain what happened.
PreserveSign-in logs, mailbox rules, message trace, endpoint alerts, VPN/firewall logs, admin changes, screenshots, and timestamps.
You getKnown facts, missing evidence, exposure scope, containment actions, and a record leadership can rely on.
Failure points
Where evidence gets lost.
Forensics fails when the team waits too long, wipes too much, or trusts one console instead of building a cross-signal timeline.
The logs expired before anyone asked the right question.
We prioritize volatile sources: sign-ins, mailbox rules, endpoint events, firewall logs, cloud audit, and vendor data.
One tool says clean while another says something moved.
3PS correlates evidence across identity, email, endpoint, cloud, network, and backup.
Everyone remembers a different version of the incident.
We build a timeline and decision record that can be shared with executives, insurers, counsel, and vendors.
First moves
Freeze the facts.
3PS moves fast enough to preserve evidence and stays disciplined enough not to turn forensics into theater.
Freeze the scene
Identify devices, accounts, mailboxes, logs, backups, and systems that should not be casually changed.
Collect the sources
Identity, email, endpoint, firewall, DNS, cloud, SaaS, backup, and vendor records.
Build the timeline
First known signal, access path, lateral movement, changes, containment actions, and recovery steps.
Scope exposure
Users, systems, data, mailboxes, sessions, files, and third parties touched or plausibly affected.
Separate known from assumed
Mark confirmed facts, likely theories, missing evidence, and decisions that changed the picture.
Build the incident record
Plain-English incident record with evidence, actions, gaps, and prevention path.
Incident brief
Incident record.
The point is not to produce a scary report. The point is to make the truth usable. When litigation-grade evidence handling is required, 3PS coordinates with counsel and licensed examiners.
TimelineWhat happened, when, how it moved, and when containment started.
ScopeUsers, devices, mailboxes, systems, data, vendors, and cloud resources reviewed.
Evidence listLogs, screenshots, exports, alerts, tickets, hashes, URLs, domains, and artifacts.
Actions takenSessions revoked, hosts isolated, rules removed, indicators blocked, restores validated.
Residual riskWhat remains unknown, what needs monitoring, and what prevents repeat failure.
Prevention path
Make the next investigation easier.
Good forensic outcomes depend on preparation: logging, retention, tool coverage, backup evidence, and clear incident ownership.
Know what evidence exists.
Logging, retention, tenant audit, endpoint coverage, firewall history, and vendor access documented before the incident.
3PS learns the environment.
Annual retainers billed monthly create context, evidence standards, and faster response under pressure.
Generate first signal.
Attack-surface, breach exposure, M365 posture, reputation, SSL, uptime, and header checks start the conversation.
Preserve now
Do not let the evidence disappear.
If you suspect compromise, fraud, insider activity, ransomware, mailbox abuse, or vendor-caused exposure, start with preservation and evidence.