Credentials and assurance

IT Rapid Support Inc. has operated since 2018. We are a combined digital forensics, privacy and IT firm: the same organization that investigates incidents and provides expert evidence also runs day-to-day IT and security for clients. That combination means our investigators understand how business systems are actually configured, and our IT team builds systems that can answer questions after an incident.

Our practices are Cyber Forensics, Privacy and AI, Legal Technology, and Managed IT. We work with businesses, law firms, in-house legal teams, and the insurers and brokers who support them.

Cloud investigations and collections from Microsoft 365 and Google Workspace can be carried out remotely; device collection is arranged for each matter, with a documented chain of custody.

IT Rapid Support carries $2 million in cyber liability insurance.

Our incident line, (289) 582-9930, is answered 24 hours a day for active incidents such as ransomware, business email compromise and suspected data theft.

We provide independent expert evidence on digital forensic questions, including email and document authenticity, device and cloud activity, and data exfiltration. Expert work is carried out on the basis that the expert's duty to the court comes first, as Ontario's Rules of Civil Procedure require, and reports are prepared to meet the applicable rules for expert evidence.

Our evidence handling is based on two widely used published references. We describe them as the methodology we follow; we do not claim certification against them.

• ISO/IEC 27037, guidelines for the identification, collection, acquisition and preservation of digital evidence
• NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response
• Write-blocked or read-only acquisition where the source allows it
• Hash verification of every forensic image and export at collection and before analysis
• Chain-of-custody records for every item, from collection to return or destruction
• Analysis on verified copies; originals preserved
• Reports that state scope, sources and limitations alongside findings

• Where counsel retains us, we report to counsel and follow counsel's instructions on communications and distribution
• Investigation files are kept separate from any managed IT work we do for the same client
• Evidence is returned or securely destroyed at the end of the engagement, as the engagement letter specifies

Before work begins you receive an engagement letter or statement of work that sets out:

• Who the client is, and whether counsel is directing the work
• The questions to be answered and the sources in scope
• Fees and an estimate for the agreed scope (fees are quoted per engagement)
• How evidence will be collected, stored, returned or destroyed
• Confidentiality terms and how findings will be reported
• Confirmation of conflict checks

Assurance pages are only useful if they are accurate, so here is what you will not see from us. We do not claim membership of any insurer's vendor panel, and we do not describe our methodology as certified or accredited against ISO or NIST publications; we follow them as references. We do not publish client names, case outcomes or statistics about past matters, because those belong to our clients.

When you assess any forensic or IT provider, including us, ask for evidence rather than badges: a sample engagement letter, a redacted report showing how limitations are stated, a certificate of insurance, and a description of how evidence is stored and destroyed. Those documents tell you more than a logo wall.