Forensic investigations and expert reports that hold up.
Forensic IT investigations for incidents, employee departures, disputes and internal matters. We acquire data with write protection and hash verification, document custody from collection to report, and write conclusions that a non-technical reader can follow and an opposing expert can test.
Fictional matter. Same structure as the reports we deliver.
$2M cyber liability insurance · Since 2018 · We work under counsel’s direction when counsel is retained
Reviewed by the ITRS security team · Last updated
IT Rapid Support Inc. provides digital forensics investigations for Toronto and GTA businesses and their lawyers, from offices in Toronto and Concord (Vaughan), and takes expert-witness work when a matter goes to court. Our method follows NIST SP 800-86, the U.S. government guide to integrating forensic techniques into incident response, so findings hold up for counsel and insurers.
For digital and computer forensics in Toronto covering computers, phones, Microsoft 365 and Google Workspace, see digital forensics in Toronto. Deep dives: Microsoft 365 and Exchange forensics, mobile device forensics and expert witness reports.
Signs it is time to bring us in.
- A departing employee may have taken client lists or files
- An internal investigation needs a neutral technical record
- Counsel needs evidence collected before it is overwritten
- Microsoft 365 or Google Workspace audit logs must be preserved and interpreted
- A dispute turns on who did what, on which device, and when
- Counsel needs an independent expert report or testimony on electronic evidence
Acquisition
Write-blocked imaging of drives and endpoints, logical and cloud collections from Microsoft 365 and Google Workspace, all hash-verified (SHA-256).
Chain of custody
Every item logged, sealed and tracked from the moment it leaves your premises to its return or secure destruction.
Analysis
File system, email, browser, USB and sync activity, sign-in and audit logs, reconstructed into a single defensible timeline.
Reporting
Findings separated from opinion, methods documented, written to be read by executives, counsel and, where needed, the court.
What you receive.
- 01Chain-of-custody record
- 02Hash-verified evidence images
- 03Forensic examination report
- 04Exhibit-ready timelines and extracts
Fictional matter. Preview of the first 3 of 10 pages.
Before you call.
- Will the findings stand up if the matter goes to court?
- Evidence is acquired with write protection, hash-verified and logged from collection to report, and the method is documented so an opposing expert can test it. We also act as the digital forensics expert witness when counsel needs one. Digital forensics expert witness.
- Do you need the device?
- Usually, or a forensic copy of it. Laptops, phones and drives can be dropped off at our Keele Street office in Concord; call first so the handover is recorded on the chain-of-custody log. Cloud evidence from Microsoft 365 or Google Workspace is collected remotely, without the device.
- Who is the report written for?
- For whoever has to rely on it: leadership, counsel, an insurer or the court. Findings are kept apart from opinion, the method is written down so another examiner can repeat it, and what we could not establish is stated plainly rather than left out.
Related services.
Incident Response
A 24/7 line to responders who contain first, preserve evidence second and explain everything.
Penetration Testing
External, internal, web application and Microsoft 365 testing, every finding verified by hand, with a retest letter when fixes are in.
Attestation & Assessments
Independent security assessments, Microsoft 365 audits and attestation letters for clients, insurers and auditors.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.