Tell Us What You Need to Understand
Perhaps an employee transferred company files before leaving. A server connected to an unfamiliar destination, or a VPN account appeared in an incident timeline. Tell us what happened, which systems were involved and the period that matters. GDF can help identify the network records that may answer the question and the device or account evidence needed alongside them.
The engagement may support counsel, an internal business matter, an insurance response or an active security event. We agree on the sources, authorized access, preservation priorities and deliverables before examination. If an event is still active, coordinate preservation with incident response so urgent containment decisions and their effect on the record are documented.
Which Network Records Are Available?
A packet capture can contain communication detail that a connection summary does not. A flow record can describe endpoints, timing and volume without retaining message or file contents. Firewall, VPN, DNS, proxy and security product records each have their own fields and recording conditions. The first task is to establish what actually exists.
Tell us who administers the firewalls, network monitoring, remote access and cloud services. Identify whether records are held locally, in a security platform or by an outside provider. Rotation, capacity and retention settings can affect how long useful material remains available. Preserve original exports and record the collection settings rather than relying only on screenshots or a vendor summary.
Connect the Traffic to Devices and Accounts
An IP address alone may not identify a person or even one device over time. DHCP assignment, NAT, shared internet connections, proxies, VPNs and cloud services can change the relationship between the address and the endpoint. Network clocks and time zones may also differ from those recorded by a computer or account provider.
The examination compares connection records with available endpoint, identity and application evidence. That may help establish which system initiated an action, whether the sequence is consistent with the reported event and which alternative explanations remain. Enterprise IT forensics addresses the broader examination across computers, servers and identity systems; this service focuses on the network record.
Assess Possible Data Movement Without Overstating It
An outbound connection or a large byte count is not, by itself, proof that a particular document was taken. Routine backups, software updates, remote administration and legitimate transfers can produce substantial traffic. Encrypted communications may reveal connection metadata while leaving the content unavailable.
Where the source permits, we compare destinations, timing, volume and available content with file activity, application records and the business context. The report distinguishes a recorded transfer, a supported inference about what moved and a question the available evidence cannot resolve. An absence of records does not establish that no transfer occurred.
Agree on the Findings and Supporting Record
Depending on the question and material available, the work can produce a source inventory, a time-aligned chronology, a connection or data-movement analysis and a technical report. Relevant exports and source references remain connected to the findings. Collection notes identify the method, period, filters, integrity checks where supported and known exceptions.
If counsel needs a declaration, report or testimony, that requirement belongs in the initial scope. Expert witness services explain the technical basis and limits of an opinion. Network analysis cannot guarantee identification of every event or attribution of an account action to a particular person.
Prepare for the First Conversation
- What happened, and when?
Describe the suspected activity, the relevant dates, the business question and any external deadline.
- Who controls the records?
Identify your IT contact, service provider and the person authorized to approve access. Note any short retention periods or planned changes.
- What has already changed?
Tell us about containment, account resets, device rebuilds, log exports or equipment replacement. Keep existing exports in their original form.
- What decision must the work support?
Explain whether you need immediate preservation, an account of the event, a review of another report or expert support for a dispute.
Use the public form for a brief description and contact details. Do not send credentials, packet captures or evidence through it. The team will arrange a suitable transfer method after the scope and authority are agreed.