Cyber Forensics & Assurance
01Practice
Cyber Forensics & Assurance
Contain the incident, preserve the evidence, and give your insurer, counsel and clients a record they can rely on.
IT Rapid Support · Vaughan, Ontario
Cyber forensics, privacy and legal technology for organizations that can’t afford to get it wrong.
We handle incident response, digital forensics, penetration testing and attestation, plus privacy and AI governance, legal technology and managed IT, all from one accountable team.
Case file · illustrative
Incident timeline, reconstructed
ITRS-IR-0000
Client name withheld
Client name withheld
Time (UTC)EventStatus
- 02:14Alert triaged: unauthorized mailbox rule on a finance account·····
- 02:31Sessions revoked, credentials reset, lateral movement contained·····
- 03:05Mailbox and sign‑in logs imaged; SHA‑256 verified·····
- 04:48Entry point confirmed: token theft via phishing page·····
- 06:20Affected parties identified for notification review·····
- 09:00Findings report and attestation letter issued·····
Chain of custody: intactReconstructing 00/06
- 01Since2018
Serving organizations across Canada
- 02Around the clock24/7
Incident response line
- 03Insured to$2M
Cyber liability insurance
- 04Based inVaughan
Headquarters, 7810 Keele St
01Four practices, one accountable team
Built for the moments when the facts matter.
Each practice stands on its own. Together they cover an organization from the first alert to the final report, and the systems in between.
Privacy, Data Governance & AI
02Practice
Privacy, Data Governance & AI
Know what personal information you hold, who can see it, and what your AI tools are allowed to do with it.
- Privacy program & readinessPIPEDA, Ontario and Quebec Law 25
- Data mapping & retentionKnow where personal data lives
- Breach notification supportReal risk of significant harm analysis
- AI governance & responsible-use policyRules leadership can sign
- Secure AI deploymentsCopilot with permissions fixed first
- AI risk assessmentsReviewed before a tool is approved
Legal Technology
03Practice
Legal Technology
Electronic evidence collected defensibly and explained clearly, and secure systems for the firms that depend on it.
- eDiscovery & forensic collectionDefensible preservation for counsel
- Litigation supportTimelines and analysis to rely on
- Expert-ready reportingFact separated from opinion
- Legal-tech advisory & implementationPractice and matter tools for firms
- Secure document & matter systemsEthical walls and audit trails
Managed IT Support
04Practice
Managed IT Support
Day-to-day IT run with the same discipline as an investigation, by people who know what a compromise looks like.
02Methodology
How an investigation runs.
The same five stages on every engagement, whether it is one compromised mailbox or a company-wide ransomware attack. Every step is written down as it happens.
- 01
Triage
A responder takes the call, establishes what is happening and what must not be touched, and agrees immediate priorities with you.
- 02
Containment
Access revoked, sessions terminated, affected systems isolated, with volatile evidence captured before it disappears.
- 03
Evidence acquisition & chain of custody
Logs, mailboxes and devices preserved with write protection, hash-verified and logged from collection onward.
- 04
Analysis
Artifacts correlated into a single UTC timeline: entry point, actions taken, data touched, and what was not affected.
- 05
Report & attestation
A written report for leadership, counsel and insurer, a remediation plan, and attestation when the evidence supports it.
03Deliverables
The work product is the document.
Reports are written to be read by executives, relied on by counsel and accepted by insurers. Findings are kept apart from opinion, methods are stated, and every exhibit traces back to a hash-verified source.
- 01Forensic investigation reports
- 02Letters of attestation
- 03Penetration test reports and retest letters
- 04Microsoft 365 and Google Workspace security audits
- 05Privacy impact and AI risk assessments
- 06Chain-of-custody records and exhibit timelines
Specimen pages. Client details withheld.
04Selected matters
Recent work, client names withheld.
Published case studies from real engagements. Each one sets out the situation, what we did and the outcome.
Forensic investigation
Pharma firm
A mailbox compromise reconstructed minute by minute, then a company-wide identity and device plan.
Read the case studyRecovery
Metrology lab
A total ERP database outage traced to its cause and every workstation back the same morning.
Read the case studyEmail security
Mississauga developer
DMARC moved from monitor-only to enforcement, with a warning banner on external mail.
Read the case studyMicrosoft 365
Fire protection company
Tenant audited, mail routing fixed and one 82,456-item mailbox cut by 62%.
Read the case study
In the first hour, the instinct is to fix everything. Our job is to stop the damage without erasing the record of what happened.
ITRS incident response practice
Organizations that rely on ITRS
Trusted from Toronto to Vancouver.
A selection of current and recent clients, from Toronto to Vancouver, across professional services, manufacturing, property, legal, healthcare, trades and retail.
- And many more since 2018.
Incident line · 24 hours, 7 days
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.